Secure parameter generating device and parameter generating method in algebraic curve crytography

ABSTRACT

The Stickelberger element computing device computes a Stickelberger element ω in an ab cyclotomic; the Jacobian addition candidate value computing device computes the Jacobian addition candidate value j and a prime number p corresponding to the Jacobian addition candidate value j, based on the prime number a, the prime number b, the size n of an encryption key, and the Stickelberger elementω; the order candidate value computing device computes a class H consisting of a plurality of candidate values for the order of the Jacobian group of an algebraic curve, based on the prime number a, the prime number b, and the Jacobian addition candidate value j; the security judging device searches for a candidate value h meeting a security condition such as almost prime number characteristic from the class H; and the parameter deciding device computes a parameter of an algebraic curve whose order of the Jacobian group is in accord with the candidate value h, of the algebraic curves specified by the prime number a, the prime number b, and the prime number p.

BACKGROUNDS OF THE INVENTION

1. Field of the Invention

The present invention relates to a secure parameter generating device, agenerating method, and a storing medium in a discrete logarithmcryptography (hereinafter, referred to an algebraic curve cryptography),and more particularly to a secure parameter generating device and itsgenerating method in a discrete logarithm cryptography using Jacobiangroup of algebraic curve.

2. Description of the Related Art

A discrete logarithm cryptography is a public key system based on thedifficulty of a discrete logarithm problem on a given finite field. Inorder to keep the security of cryptography, the order of the finitefield must be almost a prime number, that is, a factor of small integerand large integer. The algebraic curve cryptography that is one of thediscrete logarithm cryptography needs to use an algebraic curve suchthat the order of the Jacobian group is almost a prime number.

In the case of an elliptic curve that is the simplest algebraic curve,an efficient algorithm of calculating the order of the Jacobian groupover any elliptic curve is known. The detailed description is shown in,for example, “Counting points on elliptic curves over finite fields”,Journal de Theorie des Nombres, de Bordeaux 7 (1995), 219–254, Institutede Mathematique de Bordeaux, written by Rene Schoof. The elliptic curvesuch that the order of the Jacobian group is almost a prime factor canbe obtained as follows, by using the above algorithm.

-   -   1. Generate a random elliptic curve E.    -   2. Calculate the order n of the Jacobian group of E.    -   3. If n is almost a prime number, output E; otherwise, return to        1.

In the case of an algebraic curve other than an elliptic curve, noefficient algorithm of calculating the order of the Jacobian group isknown except for one hyper-elliptic curve. Therefore, the algebraiccurve which can be used in the algebraic curve cryptography is limitedto an elliptic curve or one exceptional hyper elliptic curve.

As for the h-fold operation of the elements in the Jacobian group,“Software Installation of Discrete Logarithm Cryptography Using C_(ab)curve” written by Arita, Yoshikawa, and Miyauchi, pp. 573–578, SecuritySymposium on Cryptography and Information in 1999, is known.

Further, the technique disclosed in Japanese Patent PublicationLaid-Open (Kokai) No. Heisei 6-282226 comprises a step of selecting anyprime number, storing an encryption key corresponding to the primenumber into the public file device, generating a decoding key listcorresponding to the prime number and the encryption key, and storingthe decoding key list together with the prime number into a decoder,wherein an encoder obtains a public key of a receiver (decoder) from thepublic file, to multiply the plaintext on an elliptic curve, its valueis sent to the decoder as a cryptogram, and the decoder computes aparameter of the elliptic curve from the cryptogram and selects adecoding key corresponding to the parameter by use of the decoding keylist, thereby obtaining the plaintext from the value obtained bymultiplying the cryptogram by the elliptic curve, using Chinese residuetheorem.

The above mentioned conventional technique limits the usable algebraiccurves to an elliptic curve or one of exceptional hyper-elliptic curve.Since the elliptic curve and the hyper-elliptic curve are extremelyparticular algebraic curve from the viewpoint of the whole algebraiccurves and this narrows the target for cryptanalysis, there arises asecurity problem of an algebraic curve cryptography.

SUMMARY OF THE INVENTION

An object of the present invention is to make it possible to use ahigher and complicated algebraic curve which couldn't be used, for analgebraic curve cryptography, and to provide a secure parametergenerating device in an algebraic curve cryptography for improving thesecurity of the algebraic curve cryptography.

Further, another object of the present invention is to make it possibleto use a higher and complicated algebraic curve which couldn't be used,for an algebraic curve cryptography, and to provide a secure parametergenerating method in the algebraic cryptography for improving thesecurity of the algebraic curve cryptography.

According to the first aspect of the invention, a secure parametergenerating device in an algebraic curve cryptography, comprises

-   -   an input means for receiving two different prime numbers (a, b)        specifying degree of complexity of a curve and size (n) of an        encryption key to be used,    -   a Stickelberger element computing device for computing a        Stickelberger element (ω) in an ab cyclotomic, based on the        prime number (a) and the prime number (b),    -   a Jacobian addition candidate value computing device for        computing Jacobian addition candidate value j corresponding to        the two different prime numbers a and b, and a prime number p        corresponding to the Jacobian addition candidate value j, based        on the prime number (a), the prime number (b), the size (n) of        an encryption key, and the Stickelberger element (c),    -   an order candidate value computing device for computing a class        H consisting of a plurality of candidate values for order of a        Jacobian group of an algebraic curve specified by the prime        number a and the prime number b, based on the prime number a,        the prime number b, and the Jacobian addition candidate value j,    -   a security judging device for searching for a candidate value h        meeting a security condition such as almost prime number        characteristic from the class H, according to the class H,    -   a parameter deciding device for computing a parameter of an        algebraic curve whose order of the Jacobian group is in accord        with the candidate value h, of the algebraic curves specified by        the prime number a, the prime number b, and the prime number p,        based on the prime number a, the prime number b, the prime        number p, and the candidate value h, and    -   an output device for supplying the parameter of the algebraic        curve computed by said parameter deciding device.

In the preferred construction, a secure parameter generating device inan algebraic curve cryptography further comprises

-   -   an a-storing means, a b-storing means, and an n-storing means        for respectively storing the prime number a, the prime number b,        and the size n of the encryption key received by said input        means,    -   a ω-storing means for storing a Stickelberger element ω computed        by said Stickelberger element computing device,    -   a p-storing means and a j-storing means for respectively storing        the prime number p and the Jacobian addition candidate value j        computed by said Jacobian addition candidate value computing        device,    -   an H-storing means for storing the class H computed by said        order candidate value computing device, and    -   an h-storing means for storing the candidate value h found by        said security judging device.

In another preferred construction, a secure parameter generating devicein an algebraic curve cryptography comprises

-   -   said Stickelberger element computing device for computing the        Stickelberger element ω by use of the equation        ω=Σ_(t)[<t/a>+<t/b>]σ_{−t⁻¹} (where, t runs on a typical series        of irreducible residue class with ab used as a divisor, [λ]        indicates the maximum integer not exceeding a rational number λ,        <λ> indicates a fractional portion λ−[λ] of the rational number        λ, σ_(t) indicates Galois mapping ζ→ζ^(t) in the ab cyclotomic        (ζ is the primitive ab root of 1)), based on the prime number a        and the prime number b.

In another preferred construction, a secure parameter generating devicein an algebraic curve cryptography comprises

-   -   said Jacobian addition candidate value computing device for        generating αat random, which is an algebraic integer γ        generating a prime ideal of a cyclotomic K generated by the        primitive ab root or 1 and whose absolute norm becomes the prime        number p of bit length 2n/(a−1)(b−1) or so, based on the prime        number a, the prime number b, the size n of the encryption key,        and the Stickelberger element ω, and computing the Jacobian        addition candidate value j by use of the equation j=γ^(ω).

In another preferred construction, a secure parameter generating devicein an algebraic curve cryptography comprises

-   -   said Stickelberger element computing device for computing the        Stickelberger element ω by use of the equation        ω=Σ_(t)[<t/a>+<t/b>]σ_{−t⁻¹} (where, t runs on a typical series        of irreducible residue class with ab used as a divisor, [λ]        indicates the maximum integer not exceeding a rational number λ,        <λ>indicates a fractional portion λ−[λ] of the rational number        λ, σ_(t) indicates Galois mapping ζ→ζ^(t) in the ab cyclotomic        (ζ is the primitive ab root of 1)), based on the prime number a        and the prime number b, and    -   said Jacobian addition candidate value computing device for        generating α at random, which is an algebraic integer γ        generating a prime ideal of a cyclotomic K generated by the        primitive ab root of 1 and whose absolute norm becomes the prime        number p of bit length 2n/(a−1)(b−1) or so, based on the prime        number a, the prime number b, the size n of the encryption key,        and the Stickelberger element ω, and computing the Jacobian        addition candidate value j by use of the equation j=γ^(ω.)

In another preferred construction, a secure parameter generating devicein an algebraic curve cryptography comprises

-   -   said order candidate value computing device for computing a        candidate value h_(k) for the order of the Jacobian group of an        algebraic curve specified by the parameters a and b, using the        equation h_(k)=Norm_(K|Q)(1+(−ζ)^(k)j) (where Norm_{K|Q} is a        norm mapping in the ab cyclotomic K), as for each k that is an        integer from 1 to 2ab inclusively, when ζ is the primitive ab        root of 1, based on the prime number a, the prime number b, and        the Jacobian addition candidate value j, and computing the class        of the candidate values, H={h₁,h₂, . . . ,h_(2ab)}.

In another preferred construction, a secure parameter generating devicein an algebraic curve cryptography comprises

-   -   said Stickelberger element computing device for computing the        Stickelberger element ω by use of the equation        ω=Σ_(t)[<t/a>+<t/b>]σ_{−t⁻¹} (where, t runs on a typical series        of irreducible residue class with ab used as a divisor, [λ]        indicates the maximum integer not exceeding a rational number λ,        <λ> indicates a fractional portion λ−[λ] of the rational number        λ, σ_(t) indicates Galois mapping ζ→ζ^(t) in the ab cyclotomic        (ζ is the primitive ab root of 1)), based on the prime number a        and the prime number b, and    -   said order candidate value computing device for computing a        candidate value h_(k) for the order of the Jacobian group of an        algebraic curve specified by the parameters a and b, using the        equation h_(k)=Norm_(K|Q)(1+(−ζ)^(k)j) (where Norm_{K|Q} is a        norm mapping in the ab cyclotomic K), as for each k that is an        integer from 1 to 2ab inclusively, when ζ is the primitive ab        root of 1, based on the prime number a, the prime number b, and        the Jacobian addition candidate value j, and computing the class        of the candidate values, H={h₁, h₂, . . . , h_(2ab)}.

In another preferred construction, a secure parameter generating devicein an algebraic curve cryptography comprises

-   -   said Jacobian addition candidate value computing device for        generating α at random, which is an algebraic integer γ        generating a prime ideal of a cyclotomic K generated by the        primitive ab root of 1 and whose absolute norm becomes the prime        number p of bit length 2n/(a−1)(b−1) or so, based on the prime        number a, the prime number b, the size n of the encryption key,        and the Stickelberger element ω, and computing the Jacobian        addition candidate value j by use of the equation j=γ^(ω), and    -   said order candidate value computing device for computing a        candidate value h_(k) for the order of the Jacobian group of an        algebraic curve specified by the parameters a and b, using the        equation h_(k)=Norm_(K|Q)(1+(−ζ)^(k)j) (where Norm_{K|Q} is a        norm mapping in the ab cyclotomic K), as for each k that is an        integer from 1 to 2ab inclusively, when ζis the primitive ab        root of 1, based on the prime number a, the prime number b, and        the Jacobian addition candidate value j, and computing the class        of the candidate values, H={h₁, h₂, . . . , h_(2ab)}.

In another preferred construction, secure parameter generating device inan algebraic curve cryptography comprises

-   -   said Stickelberger element computing device for computing the        Stickelberger element ω by use of the equation        ω=Σ_(t)[<t/a>+<t/b>]σ_{−t⁻¹} (where, t runs on a typical series        of irreducible residue class with ab used as a divisor, [λ]        indicates the maximum integer not exceeding a rational number λ,        <λ> indicates a fractional portion λ−[λ] of the rational number        λ, σ_(t) indicates Galois mapping ζ→ζ^(t) in the ab cyclotomic        (ζ is the primitive ab root of 1)), based on the prime number a        and the prime number b,    -   said Jacobian addition candidate value computing device for        generating α at random, which is an algebraic integer γ        generating a prime ideal of a cyclotomic K generated by the        primitive ab root of 1 and whose absolute norm becomes the prime        number p of bit length 2n/(a−1)(b−1) or so, based on the prime        number a, the prime number b, the size n of the encryption key,        and the Stickelberger element ω, and computing the Jacobian        addition candidate value j by use of the equation j=γ^(ω), and    -   said order candidate value computing device for computing a        candidate value h_(k) for the order of the Jacobian group of an        algebraic curve specified by the parameters a and b, using the        equation h_(k)=Norm_(K|Q)(1+(−ζ)^(k)j) (where Norm_{K|Q} is a        norm mapping in the ab cyclotomic K), as for each k that is an        integer from 1 to 2ab inclusively, when ζ is the primitive ab        root of 1, based on the prime number a, the prime number b, and        the Jacobian addition candidate value j, and computing the class        of the candidate values, H={h₁, h₂, . . . , h_(2ab)}.

In another preferred construction, a secure parameter generating devicein an algebraic curve cryptography comprises

-   -   said parameter deciding device for requiring the primitive a        root ζ_(a) and the primitive b root ζ_(b) of 1 with the prime        number p used as the divisor, based on the prime number a, the        prime number b, the prime number p, and the candidate value h,        generating a random point G over an algebraic curve defined by        the equation ζ_(a) ¹Y^(a)+ζ_(b) ^(m)X^(b)+1=0, as for each        integer l from 1 to a inclusively and each integer m from 1 to b        inclusively, computing the h-fold of an element in the Jacobian        group indicated by the point G, and supplying p, ζ_(a) ¹, and        ζ_(b) ^(m) as the parameter of an algebraic curve whose order of        the Jacobian group is in accord with the candidate value h, of        the algebraic curves specified by the prime number a and the        prime number b if the result is equal to an identity element in        the Jacobian group.

In another preferred construction, a secure parameter generating devicein an algebraic curve cryptography comprises

-   -   said Stickelberger element computing device for computing the        Stickelberger element ω by use of the equation        ω=Σ_(t)[<t/a>+<t/b>]σ_{−t⁻¹} (where, t runs on a typical series        of irreducible residue class with ab used as a divisor, [λ]        indicates the maximum integer not exceeding a rational number λ,        <λ> indicates a fractional portion λ−[λ] of the rational number        λ, σ_(t) indicates Galois mapping ζ→ζ^(t) in the ab cyclotomic        (ζ is the primitive ab root of 1)), based on the prime number a        and the prime number b, and    -   said parameter deciding device for requiring the primitive a        root ζ_(a) and the primitive b root ζ_(b) of 1 with the prime        number p used as the divisor, based on the prime number a, the        prime number b, the prime number p, and the candidate value h,        generating a random point G over an algebraic curve defined by        the equation ζ_(a) ¹Y^(a)+ζ_(b) ^(m)X^(b)+1=0, as for each        integer l from 1 to a inclusively and each integer m from 1 to b        inclusively, computing the h-fold of an element in the Jacobian        group indicated by the point G, and supplying p, ζ_(a) ¹, and        ζ_(b) ^(m) as the parameter of an algebraic curve whose order of        the Jacobian group is in accord with the candidate value h, of        the algebraic curves specified by the prime number a and the        prime number b if the result is equal to an identity element in        the Jacobian group.

In another preferred construction, a secure parameter generating devicein an algebraic curve cryptography comprises

-   -   said Jacobian addition candidate value computing device for        generating α at random, which is an algebraic integer γ        generating a prime ideal of a cyclotomic K generated by the        primitive ab root of 1 and whose absolute norm becomes the prime        number p of bit length 2n/(a−1)(b−1) or so, based on the prime        number a, the prime number b, the size n of the encryption key,        and the Stickelberger element ω, and computing the Jacobian        addition candidate value j by use of the equation j=γ^(ω), and    -   said parameter deciding device for requiring the primitive a        root ζ_(a) and the primitive b root ζ_(b) of 1 with the prime        number p used as the divisor, based on the prime number a, the        prime number b, the prime number p, and the candidate value h,        generating a random point G over an algebraic curve defined by        the equation ζ_(a) ¹Y_(a)+ζ_(b) ^(m)X^(b)+1=0, as for each        integer l from 1 to a inclusively and each integer m from 1 to b        inclusively, computing the h-fold of an element in the Jacobian        group indicated by the point G, and supplying p, ζ_(a) ¹, and        ζ_(b) ^(m) as the parameter of an algebraic curve whose order of        the Jacobian group is in accord with the candidate value h, of        the algebraic curves specified by the prime number a and the        prime number b if the result is equal to an identity element in        the Jacobian group.

In another preferred construction, a secure parameter generating devicein an algebraic curve cryptography comprises

-   -   said order candidate value computing device for computing a        candidate value h_(k) for the order of the Jacobian group of an        algebraic curve specified by the parameters a and b, using the        equation h_(k)=Norm_(K|Q)(1+(−ζ)^(k)j) (where Norm_{K|Q} is a        norm mapping in the ab cyclotomic K), as for each k that is an        integer from l to 2ab inclusively, when ζ is the primitive ab        root of 1, based on the prime number a, the prime number b, and        the Jacobian addition candidate value j, and computing the class        of the candidate values, H={h₁, h₂, . . . , h_(2ab)}, and    -   said parameter deciding device for requiring the primitive a        root ζ_(a) and the primitive b root ζ_(b) of 1 with the prime        number p used as the divisor, based on the prime number a, the        prime number b, the prime number p, and the candidate value h,        generating a random point G over an algebraic curve defined by        the equation ζ_(a) ¹Y^(a)+ζ_(b) ^(m)X^(b)+1=0, as for each        integer l from 1 to a inclusively and each integer m from 1 to b        inclusively, computing the h-fold of an element in the Jacobian        group indicated by the point G, and supplying p, ζ_(a) ¹, and        ζ_(b) ^(m) as the parameter of an algebraic curve whose order of        the Jacobian group is in accord with the candidate value h, of        the algebraic curves specified by the prime number a and the        prime number b if the result is equal to an identity element in        the Jacobian group.

In another preferred construction, a secure parameter generating devicein an algebraic curve cryptography comprises

-   -   said Stickelberger element computing device for computing the        Stickelberger element ω by use of the equation        ω=Σ_(t)[<t/a>+<t/b>]σ_{−t⁻¹} (where, t runs on a typical series        of irreducible residue class with ab used as a divisor, [λ]        indicates the maximum integer not exceeding a rational number λ,        <λ> indicates a fractional portion λ−[λ] of the rational number        λ, σ_(t) indicates Galois mapping ζ→ζ^(t) in the ab cyclotomic        (ζ is the primitive ab root of 1)), based on the prime number a        and the prime number b,    -   said Jacobian addition candidate value computing device for        generating α at random, which is an algebraic integer γ        generating a prime ideal of a cyclotomic K generated by the        primitive ab root of 1 and whose absolute norm becomes the prime        number p of bit length 2n/(a−1)(b−1) or so, based on the prime        number a, the prime number b, the size n of the encryption key,        and the Stickelberger element ω, and computing the Jacobian        addition candidate value j by use of the equation j=γ^(ω), and    -   said parameter deciding device for requiring the primitive a        root ζ_(a) and the primitive b root ζ_(b) of 1 with the prime        number p used as the divisor, based on the prime number a, the        prime number b, the prime number p, and the candidate value h,        generating a random point G over an algebraic curve defined by        the equation ζ_(a) ¹Y^(a)+ζ_(b) ^(m)X^(b)+1=0, as for each        integer l from 1 to a inclusively and each integer m from 1 to b        inclusively, computing the h-fold of an element in the Jacobian        group indicated by the point G, and supplying p, ζ_(a) ¹, and        ζ_(b) ^(m) as the parameter of an algebraic curve whose order of        the Jacobian group is in accord with the candidate value h, of        the algebraic curves specified by the prime number a and the        prime number b if the result is equal to an identity element in        the Jacobian group.

In another preferred construction, a secure parameter generating devicein an algebraic curve cryptography comprises

-   -   said Stickelberger element computing device for computing the        Stickelberger element ω by use of the equation        ω=Σ_(t)[<t/a>+<t/b>]σ_{−t⁻¹} (where, t runs on a typical series        of irreducible residue class with ab used as a divisor, [λ]        indicates the maximum integer not exceeding a rational number λ,        <λ> indicates a fractional portion λ−[λ] of the rational number        λ, σ_(t) indicates Galois mapping ζ→ζ^(t) in the ab cyclotomic        (ζ is the primitive ab root of 1)), based on the prime number a        and the prime number b,    -   said order candidate value computing device for computing a        candidate value h_(k) for the order of the Jacobian group of an        algebraic curve specified by the parameters a and b, using the        equation h_(k)=Norm_(K|Q)(1+(−ζ)^(k)j) (where Norm_{K|Q} is a        norm mapping in the ab cyclotomic K), as for each k that is an        integer from 1 to 2ab inclusively, when ζ is the primitive ab        root of 1, based on the prime number a, the prime number b, and        the Jacobian addition candidate value j, and computing the class        of the candidate values, H={h₁, h₂, . . . , h_(2ab)}, and    -   said parameter deciding device for requiring the primitive a        root ζ_(a) and the primitive b root ζ_(b) of 1 with the prime        number p used as the divisor, based on the prime number a, the        prime number b, the prime number p, and the candidate value h,        generating a random point G over an algebraic curve defined by        the equation ζ_(a) ¹Y^(a)+ζ_(b) ^(m)X^(b)+1=0, as for each        integer l from 1 to a inclusively and each integer m from 1 to b        inclusively, computing the h-fold of an element in the Jacobian        group indicated by the point G, and supplying p, ζ_(a) ¹, and        ζ_(b) ^(m) as the parameter of an algebraic curve whose order of        the Jacobian group is in accord with the candidate value h, of        the algebraic curves specified by the prime number a and the        prime number b if the result is equal to an identity element in        the Jacobian group.

In another preferred construction, a secure parameter generating devicein an algebraic curve cryptography comprises

-   -   said Jacobian addition candidate value computing device for        generating α at random, which is an algebraic integer γ        generating a prime ideal of a cyclotomic K generated by the        primitive ab root of 1 and whose absolute norm becomes the prime        number p of bit length 2n/(a−1)(b−1) or so, based on the prime        number a, the prime number b, the size n of the encryption key,        and the Stickelberger element ω, and computing the Jacobian        addition candidate value j by use of the equation j=γ^(ω),    -   said order candidate value computing device for computing a        candidate value h_(k) for the order of the Jacobian group of an        algebraic curve specified by the parameters a and b, using the        equation h_(k)=Norm_(K|Q)(1+(−ζ)^(k)j) (where Norm_{K|Q} is a        norm mapping in the ab cyclotomic K), as for each k that is an        integer from 1 to 2ab inclusively, when ζ is the primitive ab        root of 1, based on the prime number a, the prime number b, and        the Jacobian addition candidate value j, and computing the class        of the candidate values, H={h₁, h₂, . . . , h_(2ab)}, and    -   said parameter deciding device for requiring the primitive a        root ζ_(a) and the primitive b root ζ_(b) of 1 with the prime        number p used as the divisor, based on the prime number a, the        prime number b, the prime number p, and the candidate value h,        generating a random point G over an algebraic curve defined by        the equation ζ_(a) ¹Y^(a)+ζ_(b) ^(m)X^(b)+1=0, as for each        integer l from 1 to a inclusively and each integer m from 1 to b        inclusively, computing the h-fold of an element in the Jacobian        group indicated by the point G, and supplying p, ζ_(a) ¹, and        ζ_(b) ^(m) as the parameter of an algebraic curve whose order of        the Jacobian group is in accord with the candidate value h, of        the algebraic curves specified by the prime number a and the        prime number b if the result is equal to an identity element in        the Jacobian group.

In another preferred construction, a secure parameter generating devicein an algebraic curve cryptography comprises

-   -   said Stickelberger element computing device for computing the        Stickelberger element ω by use of the equation        ω=Σ_(t)[<t/a>+<t/b>]σ_{−t⁻¹} (where, t runs on a typical series        of irreducible residue class with ab used as a divisor, [λ]        indicates the maximum integer not exceeding a rational number λ,        <λ> indicates a fractional portion λ−[λ] of the rational number        λ, σ_(t) indicates Galois mapping ζ→ζ^(t) in the ab cyclotomic        (ζ is the primitive ab root of 1)), based on the prime number a        and the prime number b,    -   said Jacobian addition candidate value computing device for        generating α at random, which is an algebraic integer γ        generating a prime ideal of a cyclotomic K generated by the        primitive ab root of 1 and whose absolute norm becomes the prime        number p of bit length 2n/(a−1)(b−1) or so, based on the prime        number a, the prime number b, the size n of the encryption key,        and the Stickelberger element a, and computing the Jacobian        addition candidate value j by use of the equation j=γ^(ω),    -   said order candidate value computing device for computing a        candidate value h_(k) for the order of the Jacobian group of an        algebraic curve specified by the parameters a and b, using the        equation h_(k)=Norm_(K|Q)(1+(−ζ)^(k)j) (where Norm_{K|Q} is a        norm mapping in the ab cyclotomic K), as for each k that is an        integer from 1 to 2ab inclusively, when ζ is the primitive ab        root of 1, based on the prime number a, the prime number b, and        the Jacobian addition candidate value j, and computing the class        of the candidate values, H={h₁, h₂, . . . , h_(2ab)}, and    -   said parameter deciding device for requiring the primitive a        root ζ_(a) and the primitive b root ζ_(b) of 1 with the prime        number p used as the divisor, based on the prime number a, the        prime number b, the prime number p, and the candidate value h,        generating a random point G over an algebraic curve defined by        the equation ζ_(a) ¹Y^(a)+ζ_(b) ^(m)X^(b)+1=0, as for each        integer l from 1 to a inclusively and each integer m from 1 to b        inclusively, computing the h-fold of an element in the Jacobian        group indicated by the point G, and supplying p, ζ_(a) ¹, and        ζ_(b) ^(m) as the parameter of an algebraic curve whose order of        the Jacobian group is in accord with the candidate value h, of        the algebraic curves specified by the prime number a and the        prime number b if the result is equal to an identity element in        the Jacobian group.

According to the second aspect of the invention, a secure parametergenerating method in an algebraic curve, comprises the steps of

-   -   a Stickelberger element computing procedure for computing a        Stickelberger element ω in an ab cyclotomic, respectively based        on two different prime numbers a and b specifying degree of        complexity of curve,    -   a Jacobian addition candidate value computing procedure for        computing Jacobian addition candidate value j corresponding to        the two different prime numbers a and b, and a prime number p        corresponding to the Jacobian addition candidate value j,        respectively based on the prime number a, the prime number b,        the size n of an encryption key, and the Stickelberger element        ω,    -   an order candidate value computing procedure for computing a        class H consisting of a plurality of candidate values for order        of a Jacobian group of an algebraic curve specified by the prime        number a and the prime number b, respectively based on the prime        number a, the prime number b, and the Jacobian addition        candidate value j,    -   a security judging procedure for searching for a candidate value        h meeting a security condition such as almost prime number        characteristic from the class H, according to the class H, and    -   a parameter deciding procedure for computing a parameter of an        algebraic curve whose order of the Jacobian group is in accord        with the candidate value h, of the algebraic curves specified by        the prime number a, the prime number b, and the prime number p,        respectively based on the prime number a, the prime number b,        the prime number p, and the candidate value h.

In the preferred construction, a secure parameter generating method inan algebraic curve cryptography comprises

-   -   a procedure for storing a Stickelberger element ω computed by        said Stickelberger element computing procedure into said        ω-storing means,    -   a procedure for respectively storing the prime number p and the        Jacobian addition candidate value j computed by said Jacobian        addition candidate value computing procedure into said p-storing        means and j-storing means,    -   a procedure for storing the class H computed by said order        candidate value computing procedure into said H-storing means,        and    -   a procedure for storing the candidate value h found by said        security judging procedure into said h-storing means.

In another preferred construction, a secure parameter generating methodin an algebraic curve cryptography comprises

-   -   said Stickelberger element computing procedure for computing the        Stickelberger element ω by use of the equation        ω=Σ_(t)[<t/a>+<t/b>]σ_{−t⁻¹} (where, t runs on a typical series        of irreducible residue class with ab used as a divisor, [λ]        indicates the maximum integer not exceeding a rational number λ,        <λ> indicates a fractional portion λ−[λ] of the rational number        λ, σ_(t) indicates Galois mapping ζ→ζ^(t) in the ab cyclotomic        (ζ is the primitive ab root of 1)), based on the prime number a        and the prime number b.

In another preferred construction, a secure parameter generating methodin an algebraic curve cryptography comprises

-   -   said Jacobian addition candidate value computing procedure for        generating α at random, which is an algebraic integer γ        generating a prime ideal of a cyclotomic K generated by the        primitive ab root of 1 and whose absolute norm becomes the prime        number p of bit length 2n/(a−1)(b−1) or so, based on the prime        number a, the prime number b, the size n of the encryption key,        and the Stickelberger element ω, and computing the Jacobian        addition candidate value j by use of the equation j=γ^(ω).

In another preferred construction, a secure parameter generating methodin an algebraic curve cryptography comprises

-   -   said Stickelberger element computing procedure for computing the        Stickelberger element ω by use of the equation        ω=Σ_(t)[<t/a>+<t/b>]σ_{−t⁻¹} (where, t runs on a typical series        of irreducible residue class with ab used as a divisor, [λ]        indicates the maximum integer not exceeding a rational number λ,        <λ> indicates a fractional portion λ−[λ] of the rational number        λ, σ_(t) indicates Galois mapping ζ→ζ^(t) in the ab cyclotomic        (ζ is the primitive ab root of 1)), based on the prime number a        and the prime number b, and    -   said Jacobian addition candidate value computing procedure for        generating α at random, which is an algebraic integer γ        generating a prime ideal of a cyclotomic K generated by the        primitive ab root of 1 and whose absolute norm becomes the prime        number p of bit length 2n/(a−1)(b−1) or so, based on the prime        number a, the prime number b, the size n of the encryption key,        and the Stickelberger element ω, and computing the Jacobian        addition candidate value j by use of the equation j=γ^(ω).

In another preferred construction, a secure parameter generating methodin an algebraic curve cryptography comprises

-   -   said order candidate value computing procedure for computing a        candidate value h_(k) for the order of the Jacobian group of an        algebraic curve specified by the parameters a and b, using the        equation h_(k)=Norm_(K|Q)(1+(−ζ)^(k)j) (where Norm_{K|Q} is a        norm mapping in the ab cyclotomic K), as for each k that is an        integer from 1 to 2ab inclusively, when ζ is the primitive ab        root of 1, based on the prime number a, the prime number b, and        the Jacobian addition candidate value j, and computing the class        of the candidate values, H={h₁,h₂, . . . , h_(2ab)}.

In another preferred construction, a secure parameter generating methodin an algebraic curve cryptography comprises

-   -   said Stickelberger element computing procedure for computing the        Stickelberger element ω by use of the equation        ω=Σ_(t)[<t/a>+<t/b>]σ_{−t⁻¹} (where, t runs on a typical series        of irreducible residue class with ab used as a divisor, [λ]        indicates the maximum integer not exceeding a rational number λ,        <λ> indicates a fractional portion λ−[λ] of the rational number        λ, σ_(t) indicates Galois mapping ζ→ζ^(t) in the ab cyclotomic        (ζ is the primitive ab root of 1)), based on the prime number a        and the prime number b, and    -   said order candidate value computing procedure for computing a        candidate value h_(k) for the order of the Jacobian group of an        algebraic curve specified by the parameters a and b, using the        equation h_(k)=Norm_(K|Q)(1+(−ζ)^(k)j) (where Norm_{K|Q} is a        norm mapping in the ab cyclotomic K), as for each k that is an        integer from 1 to 2ab inclusively, when ζ is the primitive ab        root of 1, based on the prime number a, the prime number b, and        the Jacobian addition candidate value j, and computing the class        of the candidate values, H={h₁,h₂, . . . , h_(2ab)}.

In another preferred construction, a secure parameter generating methodin an algebraic curve cryptography comprises

-   -   said Jacobian addition candidate value computing procedure for        generating α at random, which is an algebraic integer γ        generating a prime ideal of a cyclotomic K generated by the        primitive ab root of 1 and whose absolute norm becomes the prime        number p of bit length 2n/(a−1)(b−1) or so, based on the prime        number a, the prime number b, the size n of the encryption key,        and the Stickelberger element ω, and computing the Jacobian        addition candidate value j by use of the equation j=γ^(ω), and    -   said order candidate value computing procedure for computing a        candidate value h_(k) for the order of the Jacobian group of an        algebraic curve specified by the parameters a and b, using the        equation h_(k)=Norm_(K|Q)(1+(−ζ)^(k)j) (where Norm_{K|Q} is a        norm mapping in the ab cyclotomic K), as for each k that is an        integer from 1 to 2ab inclusively, when ζ is the primitive ab        root of 1, based on the prime number a, the prime number b, and        the Jacobian addition candidate value j, and computing the class        of the candidate values, H={h₁, h₂, . . . , h_(2ab)}.

In another preferred construction, a secure parameter generating methodin an algebraic curve cryptography comprises

-   -   said Stickelberger element computing procedure for computing the        Stickelberger element ω by use of the equation        ω=Σ_(t)[<t/a>+<t/b>]σ_{−t⁻¹} (where, t runs on a typical series        of irreducible residue class with ab used as a divisor, [λ]        indicates the maximum integer not exceeding a rational number λ,        <λ> indicates a fractional portion λ−[λ] of the rational number        λ, σ_(t) indicates Galois mapping ζ→ζ^(t) in the ab cyclotomic        (ζ is the primitive ab root of 1)), based on the prime number a        and the prime number b,    -   said Jacobian addition candidate value computing procedure for        generating α at random, which is an algebraic integer γ        generating a prime ideal of a cyclotomic K generated by the        primitive ab root of 1 and whose absolute norm becomes the prime        number p of bit length 2n/(a−1)(b−1) or so, based on the prime        number a, the prime number b, the size n of the encryption key,        and the Stickelberger element ω, and computing the Jacobian        addition candidate value j by use of the equation j=γ^(ω), and    -   said order candidate value computing procedure for computing a        candidate value h_(k) for the order of the Jacobian group of an        algebraic curve specified by the parameters a and b, using the        equation h_(k)=Norm_(K|Q)(1+(−ζ)^(k)j) (where Norm_{K|Q} is a        norm mapping in the ab cyclotomic K), as for each k that is an        integer from 1 to 2ab inclusively, when ζ is the primitive ab        root of 1, based on the prime number a, the prime number b, and        the Jacobian addition candidate value j, and computing the class        of the candidate values, H={h₁, h₂, . . . , h_(2ab)}.    -   In another preferred construction, a secure parameter generating        method in an algebraic curve cryptography comprises    -   said parameter deciding procedure for requiring the primitive a        root ζ_(a) and the primitive b root ζ_(b) of 1 with the prime        number p used as the divisor, based on the prime number a, the        prime number b, the prime number p, and the candidate value h,        generating a random point G over an algebraic curve defined by        the equation ζ_(a) ¹Y^(a)+ζ_(b) ^(m)X^(b)+1=0, as for each        integer l from 1 to a inclusively and each integer m from 1 to b        inclusively, computing the h-fold of an element in the Jacobian        group indicated by the point G, and supplying p, ζ_(a) ¹, and        ζ_(b) ^(m) as the parameter of an algebraic curve whose order of        the Jacobian group is in accord with the candidate value h, of        the algebraic curves specified by the prime number a and the        prime number b if the result is equal to an identity element in        the Jacobian group.

In another preferred construction, a secure parameter generating methodin an algebraic curve cryptography comprises

-   -   said Stickelberger element computing procedure for computing the        Stickelberger element ω by use of the equation        ω=Σ_(t)[<t/a>+<t/b>]σ_{−t⁻¹} (where, t runs on a typical series        of irreducible residue class with ab used as a divisor, [λ]        indicates the maximum integer not exceeding a rational number λ,        <λ> indicates a fractional portion λ−[λ] of the rational number        λ, σ_(t) indicates Galois mapping ζ→ζ^(t) in the ab cyclotomic        (ζ is the primitive ab root of 1)), based on the prime number a        and the prime number b, and    -   said parameter deciding procedure for requiring the primitive a        root ζ_(a) and the primitive b root ζ_(b) of 1 with the prime        number p used as the divisor, based on the prime number a, the        prime number b, the prime number p, and the candidate value h,        generating a random point G over an algebraic curve defined by        the equation ζ_(a) ¹Y^(a)+ζ_(b) ^(m)X^(b)+1=0, as for each        integer l from 1 to a inclusively and each integer m from 1 to b        inclusively, computing the h-fold of an element in the Jacobian        group indicated by the point G, and supplying p, ζ_(a) ¹, and        ζ_(b) ^(m) as the parameter of an algebraic curve whose order of        the Jacobian group is in accord with the candidate value h, of        the algebraic curves specified by the prime number a and the        prime number b if the result is equal to an identity element in        the Jacobian group.

In another preferred construction, a secure parameter generating methodin an algebraic curve cryptography comprises

-   -   said Jacobian addition candidate value computing procedure for        generating α at random, which is an algebraic integer γ        generating a prime ideal of a cyclotomic K generated by the        primitive ab root of 1 and whose absolute norm becomes the prime        number p of bit length 2n/(a−1)(b−1) or so, based on the prime        number a, the prime number b, the size n of the encryption key,        and the Stickelberger element ω, and computing the Jacobian        addition candidate value j by use of the equation j=γ^(ω, and)    -   said parameter deciding procedure for requiring the primitive a        root ζ_(a) and the primitive b root ζ_(b) of 1 with the prime        number p used as the divisor, based on the prime number a, the        prime number b, the prime number p, and the candidate value h,        generating a random point G over an algebraic curve defined by        the equation ζ_(a) ¹Y^(a)+ζ_(b) ^(m)X^(b)+1=0, as for each        integer l from 1 to a inclusively and each integer m from 1 to b        inclusively, computing the h-fold of an element in the Jacobian        group indicated by the point G, and supplying p, ζ_(a) ¹, and        ζ_(b) ^(m) as the parameter of an algebraic curve whose order of        the Jacobian group is in accord with the candidate value h, of        the algebraic curves specified by the prime number a and the        prime number b if the result is equal to an identity element in        the Jacobian group.

In another preferred construction, a secure parameter generating methodin an algebraic curve cryptography comprises

-   -   said order candidate value computing procedure for computing a        candidate value h_(k) for the order of the Jacobian group of an        algebraic curve specified by the parameters a and b, using the        equation h_(k)=Norm_(K|Q)(1+(−ζ)^(k)j) (where Norm_{K|Q} is a        norm mapping in the ab cyclotomic K), as for each k that is an        integer from 1 to 2ab inclusively, when ζ is the primitive ab        root of 1, based on the prime number a, the prime number b, and        the Jacobian addition candidate value j, and computing the class        of the candidate values, H={h₁, h₂, . . . , h_(2ab)}, and    -   said parameter deciding procedure for requiring the primitive a        root ζ_(a) and the primitive b root ζ_(b) of 1 with the prime        number p used as the divisor, based on the prime number a, the        prime number b, the prime number p, and the candidate value h,        generating a random point G over an algebraic curve defined by        the equation ζ_(a) ¹Y^(a)+ζ_(b) ^(m)X^(b)+1=0, as for each        integer l from 1 to a inclusively and each integer m from 1 to b        inclusively, computing the h-fold of an element in the Jacobian        group indicated by the point G, and supplying p, ζ_(a) ¹, and        ζ_(b) ^(m) as the parameter of an algebraic curve whose order of        the Jacobian group is in accord with the candidate value h, of        the algebraic curves specified by the prime number a and the        prime number b if the result is equal to an identity element in        the Jacobian group.

In another preferred construction, a secure parameter generating methodin an algebraic curve cryptography comprises

-   -   said Stickelberger element computing procedure for computing the        Stickelberger element ω by use of the equation        ω=Σ_(t)[<t/a>+<t/b>]σ_{−t⁻¹} (where, t runs on a typical series        of irreducible residue class with ab used as a divisor, [λ]        indicates the maximum integer not exceeding a rational number λ,        <λ> indicates a fractional portion λ−[λ] of the rational number        λ, σ_(t) indicates Galois mapping ζ→ζ^(t) in the ab cyclotomic        (ζ is the primitive ab root of 1)), based on the prime number a        and the prime number b,    -   said Jacobian addition candidate value computing procedure for        generating α at random, which is an algebraic integer γ        generating a prime ideal of a cyclotomic K generated by the        primitive ab root of 1 and whose absolute norm becomes the prime        number p of bit length 2n/(a−1)(b−1) or so, based on the prime        number a, the prime number b, the size n of the encryption key,        and the Stickelberger element ω, and computing the Jacobian        addition candidate value j by use of the equation j=γ^(ω), and    -   said parameter deciding procedure for requiring the primitive a        root ζ_(a) and the primitive b root ζ_(b) of 1 with the prime        number p used as the divisor, based on the prime number a, the        prime number b, the prime number p, and the candidate value h,        generating a random point G over an algebraic curve defined by        the equation ζ_(a) ¹Y^(a)+ζ_(b) ^(m)X^(b)+1=0, as for each        integer l from 1 to a inclusively and each integer m from 1 to b        inclusively, computing the h-fold of an element in the Jacobian        group indicated by the point G, and supplying p, ζ_(a) ¹, and        ζ_(b) ^(m) as the parameter of an algebraic curve whose order of        the Jacobian group is in accord with the candidate value h, of        the algebraic curves specified by the prime number a and the        prime number b if the result is equal to an identity element in        the Jacobian group.

In another preferred construction, a secure parameter generating methodin an algebraic curve cryptography comprises

-   -   said Stickelberger element computing procedure for computing the        Stickelberger element ω by use of the equation        ω=Σ_(t)[<t/a>+<t/b>]σ_{−t⁻¹} (where, t runs on a typical series        of irreducible residue class with ab used as a divisor, [λ]        indicates the maximum integer not exceeding a rational number λ,        <λ> indicates a fractional portion λ−[λ] of the rational number        λ, σ_(t) indicates Galois mapping ζ→ζ^(t) in the ab cyclotomic        (ζ is the primitive ab root of 1)), based on the prime number a        and the prime number b,    -   said order candidate value computing procedure for computing a        candidate value h_(k) for the order of the Jacobian group of an        algebraic curve specified by the parameters a and b, using the        equation h_(k)=Norm_(K|Q)(1+(−ζ)^(k)j) (where Norm_{K|Q} is a        norm mapping in the ab cyclotomic K), as for each k that is an        integer from 1 to 2ab inclusively, when ζ is the primitive ab        root of 1, based on the prime number a, the prime number b, and        the Jacobian addition candidate value j, and computing the class        of the candidate values, H={h₁,h₂, . . . , h_(2ab)}, and    -   said parameter deciding procedure for requiring the primitive a        root ζ_(a) and the primitive b root ζ_(b) of 1 with the prime        number p used as the divisor, based on the prime number a, the        prime number b, the prime number p, and the candidate value h,        generating a random point G over an algebraic curve defined by        the equation ζ_(a) ¹Y^(a)+ζ_(b) ^(m)X^(b)+1=0, as for each        integer l from 1 to a inclusively and each integer m from 1 to b        inclusively, computing the h-fold of an element in the Jacobian        group indicated by the point G, and supplying p, ζ_(a) ¹, and        ζ_(b) ^(m) as the parameter of an algebraic curve whose order of        the Jacobian group is in accord with the candidate value h, of        the algebraic curves specified by the prime number a and the        prime number b if the result is equal to an identity element in        the Jacobian group.

In another preferred construction, a secure parameter generating methodin an algebraic curve cryptography comprises

-   -   said Jacobian addition candidate value computing procedure for        generating α at random, which is an algebraic integer γ        generating a prime ideal of a cyclotomic K generated by the        primitive ab root of 1 and whose absolute norm becomes the prime        number p of bit length 2n/(a−1)(b−1) or so, based on the prime        number a, the prime number b, the size n of the encryption key,        and the Stickelberger element ω, and computing the Jacobian        addition candidate value j by use of the equation j=γ^(ω),    -   said order candidate value computing procedure for computing a        candidate value h_(k) for the order of the Jacobian group of an        algebraic curve specified by the parameters a and b, using the        equation h_(k)=Norm_(K|Q)(1+(−ζ)^(k)j) (where Norm_{K|Q} is a        norm mapping in the ab cyclotomic K), as for each k that is an        integer from 1 to 2ab inclusively, when ζ is the primitive ab        root of 1, based on the prime number a, the prime number b, and        the Jacobian addition candidate value j, and computing the class        of the candidate values, H={h₁, h₂, . . . , h_(2ab)}, and    -   said parameter deciding procedure for requiring the primitive a        root ζ_(a) and the primitive b root ζ_(b) of 1 with the prime        number p used as the divisor, based on the prime number a, the        prime number b, the prime number p, and the candidate value h,        generating a random point G over an algebraic curve defined by        the equation ζ_(a) ¹Y^(a)+ζ_(b) ^(m)X^(b)+1=0, as for each        integer l from 1 to a inclusively and each integer m from 1 to b        inclusively, computing the h-fold of an element in the Jacobian        group indicated by the point G, and supplying p, ζ_(a) ¹, and        ζ_(b) ^(m) as the parameter of an algebraic curve whose order of        the Jacobian group is in accord with the candidate value h, of        the algebraic curves specified by the prime number a and the        prime number b if the result is equal to an identity element in        the Jacobian group.

In another preferred construction, a secure parameter generating methodin an algebraic curve cryptography comprises

-   -   said Stickelberger element computing procedure for computing the        Stickelberger element ω by use of the equation        ω=Σ_(t)[<t/a>+<t/b>]σ_{−t⁻¹} (where, t runs on a typical series        of irreducible residue class with ab used as a divisor, [λ]        indicates the maximum integer not exceeding a rational number λ,        <λ> indicates a fractional portion λ−[λ] of the rational number        λ, σ_(t) indicates Galois mapping ζ→ζ^(t) in the ab cyclotomic        (ζ is the primitive ab root of 1)), based on the prime number a        and the prime number b,    -   said Jacobian addition candidate value computing procedure for        generating α at random, which is an algebraic integer γ        generating a prime ideal of a cyclotomic K generated by the        primitive ab root of 1 and whose absolute norm becomes the prime        number p of bit length 2n/(a−1)(b−1) or so, based on the prime        number a, the prime number b, the size n of the encryption key,        and the Stickelberger element ω, and computing the Jacobian        addition candidate value j by use of the equation j=γ^(ω),    -   said order candidate value computing procedure for computing a        candidate value h_(k) for the order of the Jacobian group of an        algebraic curve specified by the parameters a and b, using the        equation h_(k)=Norm_(K|Q)(1+(−ζ)^(k)j) (where Norm_{K|Q} is a        norm mapping in the ab cyclotomic K), as for each k that is an        integer from 1 to 2ab inclusively, when ζ is the primitive ab        root of 1, based on the prime number a, the prime number b, and        the Jacobian addition candidate value j, and computing the class        of the candidate values, H={h₁, h₂, . . . , h_(2ab)}, and    -   said parameter deciding procedure for requiring the primitive a        root ζ_(a) and the primitive b root ζ_(b) of 1 with the prime        number p used as the divisor, based on the prime number a, the        prime number b, the prime number p, and the candidate value h,        generating a random point G over an algebraic curve defined by        the equation ζ_(a) ¹Y^(a)+ζ_(b) ^(m)X^(b)+1=0, as for each        integer l from 1 to a inclusively and each integer m from 1 to b        inclusively, computing the h-fold of an element in the Jacobian        group indicated by the point G, and supplying p, ζ_(a) ¹, and        ζ_(b) ^(m) as the parameter of an algebraic curve whose order of        the Jacobian group is in accord with the candidate value h, of        the algebraic curves specified by the prime number a and the        prime number b if the result is equal to an identity element in        the Jacobian group.

According to another aspect of the invention, a computer readable memorystoring a program for generating a secure parameter in an algebraiccurve cryptography, to run the program on a computer,

-   -   the program comprises the steps of    -   a Stickelberger element computing procedure for computing a        Stickelberger element ω in an ab cyclotomic, respectively based        on two different prime numbers a and b specifying degree of        complexity of curve,    -   a Jacobian addition candidate value computing procedure for        computing Jacobian addition candidate value j corresponding to        the two different prime numbers a and b, and a prime number p        corresponding to the Jacobian addition candidate value j,        respectively based on the prime number a, the prime number b,        the size n of an encryption key, and the Stickelberger element        ω,    -   an order candidate value computing procedure for computing a        class H consisting of a plurality of candidate values for order        of a Jacobian group of an algebraic curve specified by the prime        number a and the prime number b, respectively based on the prime        number a, the prime number b, and the Jacobian addition        candidate value j,    -   a security judging procedure for searching for a candidate value        h meeting a security condition such as almost prime number        characteristic from the class H, according to the class H, and    -   a parameter deciding procedure for computing a parameter of an        algebraic curve whose order of the Jacobian group is in accord        with the candidate value h, of the algebraic curves specified by        the prime number a, the prime number b, and the prime number p,        respectively based on the prime number a, the prime number b,        the prime number p, and the candidate value h.

Other objects, features and advantages of the present invention willbecome clear from the detailed description given herebelow.

BRIEF DESCRIPTION OF THE DRAWINGS

The present invention will be understood more fully from the detaileddescription given herebelow and from the accompanying drawings of thepreferred embodiment of the invention, which, however, should not betaken to be limitative to the invention, but are for explanation andunderstanding only.

In the drawings:

FIG. 1 is a block diagram showing the form of the first embodimentaccording to the present invention;

FIG. 2 is a flow chart showing the operation of a Stickelberger elementcomputing device;

FIG. 3 is a flow chart showing an operation of the Jacobian additivecandidate value computing device;

FIG. 4 is a flow chart showing the operation of the order candidatevalue computing device;

FIG. 5 is a flow chart showing the parameter deciding device;

FIG. 6 is a block diagram showing the form of the third embodiment ofthe present invention.

DESCRIPTION OF THE PREFERRED EMBODIMENT

The preferred embodiment of the present invention will be discussedhereinafter in detail with reference to the accompanying drawings. Inthe following description, numerous specific details are set forth inorder to provide a thorough understanding of the present invention. Itwill be obvious, however, to those skilled in the art that the presentinvention may be practiced without these specific details. In otherinstance, well-known structures are not shown in detail in order tounnecessary obscure the present invention.

First, the principle of the present invention will be described.

The present invention is to efficiently search for an algebraic curvesuch that the order of the Jacobian group is almost a prime number, fromthe class of an algebraic curve having the definition expression such asαY^(a)+βX^(b)+1=0, and to make it possible to use a higher andcomplicated algebraic curve that couldn't be used, for an algebraiccurve cryptography. Here, the parameters a and b indicate the degree ofcomplexity of curves.

The algebraic curve over a finite field F_(q) of the order q, which hasthe definition expression such as αY^(a)+βX^(b)+1=0, is defined as C(q,α, β). As for the algebraic curve C(q, α, β), the order of the Jacobiangroup can be designed using the description about its L function by useof the Jacobian addition.

Hereafter, for brief description, assume that q:=p (p is expressed by q)is a prime number, and that the expression, p≡1 mod LCM(a, b) issatisfied (LCM is the least common multiple). Further, the primitive abroot of 1 is defined as ζ. The prime number p is completely factorizedinto m pieces of prime ideals, P₁, P₂, . . . , P_(m) in a cyclotomicQ(ζ). Here, the number m is the number of irreducible residue classes ofthe divisor ab.

The generator w of the multiplication group F_(p) ^(*) of the finitefield F_(p) is fixed, and the index χ_(s) of F_(p) ^(*), as for therational number such that (p−1)s becomes an integer, is defined asχ_(s)(w)=exp(2π is) (where i is an imaginary number). Assuming thatχ_(s)(0)=0 (s: when it is not an integer), =1 (s: when it is aninteger), the domain is expanded on the whole F_(p). As for the integerl=1, 2, . . . , a−1 and the integer m=1, 2, . . . , b−1, the expression,j_(p)(l, m)=Σ_(—){1+v₁+v₂=0}χ_(l/a)(V₁)χ_(m/b)(V₂) is called as Jacobianaddition. Where, v₁ and v₂ run on v₁, v₂∈F_(p) meeting the equation1+v₁+v₂=0. At this time, it is well known that the L function L_(p)(U)of C(p, α, β) can be expressed by using the Jacobian addition asfollows.

L_(p)(U)=π_(l=1, 2, . . . a−1, m=1, 2 . . . b−1)(1+χ_(l/a)(α⁻¹)χ_(m/b)(β⁻¹)j_(p)(l, m) U). Therefore, the order h of the Jacobian group of C(p, α,β) is given byh=L_(p)(1)=π_(l=1, 2, . . . , a−1, m=1, 2, . . . , b−1)(1+χ_(l/a)(α⁻¹)χ_(m/b)(β⁻¹) j_(p)(l, m)). It is necessary to calculate the Jacobianaddition j_(p)(l, m), in order to require the order of the Jacobiangroup. However, since it is impossible to directly calculate theJacobian addition j_(p)(l, m) according to the definition expression,from the viewpoint of the volume of calculation, the Stickelbergerelement as for the following Jacobian addition is used.

Assume that [λ] indicates the maximum integer not exceeding the rationalnumber λ and that <λ> indicates the fraction part λ−[λ] of the rationalnumber λ. Further, assume that σ_(t) indicates the Galois mappingζ→ζ^(t) of the cyclotomic field Q(ζ). The Stickelberger element ω(a, b)that is the generator of the group ring Z[Gal(Q(ζ)|Q)] is defined asω(a, b)=Σ_(t)[<t/a>+<t/b>]σ_(−t) ⁻¹. Where, t runs on the typical seriesof the irreducible residue class with the divisor ab.

It is well known that the expression (j_(p)(l, m))=p^(ω(a, b)) issatisfied as the ideal of the cyclotomic field Q(ζ). Where, P is theprime ideal on p. By the above expression, j_(p)(l, m) is necessarilyresolved except for the 2ab root of 1. Of the results, the degree offreedom for ab root can be obtained by the degree of freedom of thecoefficient α, β∈F_(q) of C(p, α, β).

In these ways, the search algorithm of the following secure curve C(p,α, β) can be obtained. The search algorithm of the secure curve C(p, α,β)

-   input: the number of Jacobian bits n-   output: p, α, β-   (1) g←(a−1)(b−1)/2-   (2) The candidate j of the Jacobian addition as for the prime number    p of some n/g bit or the like is searched for by using the    calculation algorithm of the candidate value of the Jacobian    addition as described later: (p, j)←{calculation algorithm of the    candidate value of the Jacobian addition}(n/g).-   (3) as for the respective k=0, 1, . . . , ab,    h_(k)←π_(l=1, 2, . . . , a−1, m=1, 2, . . . , b−1)(1+(−ζ)^(k)j)-   (4) Check whether there is an almost prime number h_(k) in {h₀, h₁,    . . . , h_(ab)}. If there is none, return to (1). If there is,    h:=h_(k) is defined.-   (5) The symbols ζ_(a), ζ_(b) are respectively defined as a-root of 1    and b-root of 1 in F_(p). Check whether the order of the Jacobian    group of the curve C(p, ζ_(a) ¹, ζ_(b) ^(m)):ζ_(a) ¹y^(a)+ζ_(b) ^(m)    x^(b)+1=0 is equal to h, as for the respective l=0, 1, . . . , a−1    and the respective m=0, 1, . . . , b−1. If it is equal, output p,    α=ζ_(a) ¹, β=ζ_(b) ^(m) and finish the operation. If such l and m    don't exist, return to (2).

In the calculation algorithm of the candidate value of the Jacobianaddition used in the above, the candidate value of the Jacobian additionis required by using the above-mentioned Stickelberger element ω(a,b)=Σ_(t)[<t/a>+<t/b>]σ_(−t) ⁻¹.

The calculation algorithm of the candidate value of the Jacobianaddition is as follows.

-   input: the number of bits m,-   output: p, j,-   (1)ω←Σ_(t)(<t/a>+<t/b>)σ_(−t) ⁻¹,-   (2) Generate γ₀=Σ_(l=0) ^(m−1) c₁ζ¹(−10<c₁<10) at random.-   (3) as for the respective i=1, 2, . . . ,-   γ←γ₀+I,-   p←Norm_(Q(ζ)|Q)(γ),-   Is p smaller than m bit or so?-   yes→continue,-   Is p larger than m bit or so?-   yes→to (2),-   Is p a prime number?-   no→continue,-   (4) Output j←γ^(ω), p and j, and finish.

This time, the form of the first embodiment of the present inventionwill be described with reference to the accompanying drawings. FIG. 1 isa block diagram showing the form of the first embodiment.

With reference to FIG. 1, the form of the first embodiment of thepresent invention comprises a Stickelberger element computing device 11,a Jacobian addition candidate value computing device 12, an ordercandidate value computing device 13, a security judging device 14, aparameter deciding device 15, a memory 16, an input device 17, an outputdevice 18, and a central processing unit 19.

The memory 16 includes a a-storing file 161, a b-storing file 162, aω-storing file 163, a j-storing file 164, an H-storing file 165, anh-storing file 166, a p-storing file 167, and an n-storing file 168.

Hereinafter, assume that a known method is used for the norm arithmeticN_(Q(ζ)|Q) and four fundamental arithmetic rules of algebraic number inthe cyclotomic field Q(ζ), arithmetic of the function of the Galoisgroup G(Q(ζ)|Q) for the cyclotomic field Q(ζ), and addition andmultiplication in the group ring Z[G(Q(ζ)|Q)] on the Galois groupG(Q(ζ)|Q) of the integer ring Z coefficient.

The operation of the form of a first embodiment according to the presentinvention will be described this time.

FIG. 2 is a flow chart showing the operation of the Stickelbergerelement computing device 11. FIG. 3 is a flow chart showing theoperation of the Jacobian addition candidate value computing device 12.FIG. 4 is a flow chart showing the operation of the order candidatevalue computing device 13. FIG. 5 is a flow chart showing the operationof the parameter deciding device 15.

The description will be made in the case where two different primenumbers, a=3, b=7, specifying the degree of complexity of a curve, andthe size n=160 of an encryption key to be used are supplied from theinput device 17. The supplied a and b are temporarily stored in thea-storing file 161 and the b-storing file 162 respectively, through thecentral processing unit 19. Further, a variable found in the followingdescription is stored in the memory 16.

The Stickelberger element computing device 11 obtains a=3, b=7 from thea-storing file 161 and the b-storing file 162, according to theoperation as shown in FIG. 2, and operates as follows.

A typical series {1, 2, 4, 5, 8, 10, 11, 13, 16, 17, 19, 20} of theirreducible residue class with a·b=3×7=21 used for the variable L as thedivisor is stored in Step S21 of FIG. 2.

As for the respective integers t included in the variable L={1, 2, 4, 5,8, 10, 11, 13, 16, 17, 19, 20} in Step 22 of FIG. 2, for example, as fort=1, since [<1/3>+<1/7>]=[1/3+1/7]=[10/21 ]=0, 0 is stored in thevariable m; since −1⁻¹≡−1≡20 mod 21, 20 is stored in the variable s;since 0×σ₂₀=0, 0 is stored in the variable λ₁.

As for the other t, since [<2/3>+<2/7>]=[2/3+2/7]=[20/21]=0, 0 is storedin the variableλ₂; since [<4/3>+<4/7>]=[1/3+4/7]=[19/21]=0, 0 is storedin the variable λ₄; since [<5/3>+<5/7>]=[2/3+5/7]=[29/21]=1 and(−5)⁻¹≡16⁻¹≡4 mod 21, σ₄ is stored in the variable λ₅; since[<8/3>+<8/7>]=[2/3+1/7]=[17/21]=0, 0 is stored in the variableλ₈; since[<10/3>+<10/7>]=[1/3+3/7]=[16/21]=0, 0 is stored in the variable λ₁₀;since [<11/3>+<11/7>]=[2/3+4/7]=[26/21]=1 and (−11)⁻¹≡10⁻¹≡19 mod 21,σ₁₉ is stored in the variable λ₁₁; since[<13/3>+<13/7>]=[1/3+6/7]=[25/21]=1 and (−13)⁻¹≡8⁻¹≡8mod 21, σ₈ isstored in the variable λ₁₃; since [<16/3>+<16/7>]=[1/3+2/7]=[13/21]=0, 0is stored in the variableλ₁₆; since [<17/3>+<17/7>]=[2/3+3/7]=[23/21]=1and (−17)⁻¹≡4⁻¹≡16 mod 21, σ₁₆ is stored in the variable λ₁₇; since[<19/3>+<19/7>]=[1/3+5/7]=[22/21]=1 and (−19)⁻¹≡2⁻¹≡11 mod 21, σ₁₁ isstored in the variable λ₁₉; and since[<20/3>+<20/7>]=[2/3+6/7]=[32/21]=1 and (−20)⁻¹≡1⁻¹≡1 mod 21, σ₁ isstored in the variable λ₂₀, in the same way.

The total ω=σ₄+σ₁₉+σ₈+σ₁₆+σ₁₁+σ₁ of the whole data stored in therespective variables λ₁, λ₂, λ₄, λ₅, λ₈, λ₁₀, λ₁₁, λ₁₃, λ₁₆, λ₁₇, λ₁₉,λ₂₀ is computed in Step S23 of FIG. 2. Here, the total means the totalin the group ring Z [G(Q(ζ)|Q)], indicating the total of thecoefficients of the respective σ_(i) with the respective σ_(i) regardedas symbols. The arithmetic result ω is temporarily stored in theω-storing file 163 through the central processing unit 19.

The Jacobian addition candidate value computing device 12 obtains a=3,b=7, n=160, ω=σ₄+σ₁₉+σ₈+σ₁₆+σ₁₁+σ₁ from the a-storing file 161, theb-storing file 162, the n-storing file 168, and the ω-storing file 163and computes the candidate value j of the Jacobian addition, accordingto the processing as shown in FIG. 3, as follows.

Since ab=21, the primitive 21^(st) power root of 1 is stored in thevariable ζ, and since 2n/(a−1)(b−1)=26.6 . . . , 27 is stored in thevariable m, in Step 31 of FIG. 3.

The random integer of the cyclotomic field Q(ζ) is stored in thevariable γ₀ as follow, in Step S32 of FIG. 3. The variable γ₀ isinitialized to 0; the random number r₀=−2 is generated as for t=0,r₀ζ⁰=−2 is added to γ₀, so to require γ₀=−2; the random number r₁=2 isgenerated as for t=1, r₁ζ¹=2ζ is added to γ₀, so to require γ₀=−2+2; andthe same operation is repeated until t=11, so to requireγ₀=−2+2ζ−ζ²+2ζ³+2ζ⁵−ζ⁶−ζ⁷−2ζ⁸+2ζ⁹−ζ¹¹, in Step S32 of FIG. 3.

The following operation will be performed on the respective integersi=0, 1, 2, . . . , in Step S33 of FIG. 3. As for i=0, γ₀+0 is stored inthe variable γ, so to obtain γ=−2+2ζ−ζ²+2ζ³+2ζ⁵−ζ⁶−ζ⁷−2ζ⁸+2ζ⁹−ζ¹¹, tocompute the norm N_(Q(ζ)|Q)(γ). The resultant 129571513 is stored in thep-storing file 167, the number of bits 29 of p=129571513 is stored inthe variable 1. That 1=29 and m=27 or so is confirmed. When p=129571513is factorized into prime factors in the known way,p=129571513=43×211×14281 is obtained. Since p=129571513 is not a primenumber, the operation as for i=0 is finished, and as for i=1, the sameoperation will be repeated. In the form of this embodiment, the sameoperation is continued until i=2. As for i=2, γ₀+2 is stored in thevariable γ, so to obtain γ=2ζ−ζ²+2ζ³+2ζ⁵−ζ⁶−ζ⁷−2ζ⁸+2ζ⁹−ζ¹¹, to computethe norm N_(Q(ζ)|Q)(γ). The resultant 163255597 is stored in thep-storing file 167, and the number of bits 28 of p=163255597 is storedin the variable 1. Since 1=28 and m=27 or so, and p=163255597 isdetermined as a prime number (a known method is used for judgment of aprime number), the operation of Step S33 will be finished.

In Step S34 of FIG. 3, the Stickelberger element ω=σ₄+σ₁₉+σ₈+σ₁₆+σ₁₁+σ₁is adopted to work on the value 2ζ−ζ²+2ƒ³+2ζ⁵−ζ⁶−ζ⁷−2ζ⁸+2ζ⁹−ζ¹¹ of thevariable γ and the result is stored in the j-storing file 164.

Namely, sincej=σ₄(γ)σ₁₉(γ)σ₈(γ)σ₁₆(γ)σ₁₁(γ)σ₁(γ)=−11346+4158ζ+9337ζ²−1093ζ³+3060ζ⁴+11132ζ⁵−1408ζ⁶−10000ζ⁷+7506ζ⁸+1237ζ⁹−9894ζ¹⁰+16406ζ¹¹, the content of the j-storing file 164becomes−11346+4158ζ+9337ζ²−10930ζ³+3060ζ⁴+11132ζ⁵−1408ζ⁶−10000ζ⁷+7506ζ⁸+1237ζ⁹−9894ζ¹⁰+16406ζ¹¹.

The order candidate value computing device 13 obtains a, b, jrespectively from the a-storing file 161, the b-storing file 162, andthe j-storing file 164, according to the processing as shown in FIG. 4,and computes each candidate value for the order of the Jacobian group,as follows.

Since ab=21, the primitive 21^(st) power root of 1 is stored in thevariable ζ, in Step S41 of FIG. 4.

In Step S42 of FIG. 4, N_(Q(ζ)|Q)(1+(−ζ)^(k)j) is computed as for therespective integers k=1, . . . , 2ab=42, by using the Jacobian additioncandidate value j, and the result is stored in the variable h_(k).Namely, sinceN_(Q(ζ)|Q)(1+(−ζ)j)=18945750554224674862720917379214050968749547249577as for k=1, 18945750554224674862720917379214050968749547249577 is storedin the variable h₁, and since N_(Q(ζ)|Q) (1+(−ζ)²j)=18928969305265796978830941938772180777050417721949 as for k=2,18928969305265796978830941938772180777050417721949 is stored in thevariable h₂.

Hereinafter, in the same way,18939442397757559639176586128404383479076142135761 is stored in thevariable h₃; 18935060345406437247984249590121980321244862496761 isstored in the variable h₄;18935622676852726684902816970612470237474541809664 is stored in thevariable h₅; 18931936903665705475581647305574444786263237069081 isstored in the variable h₆;18929560654771860101383318185997674116929626012889 is stored in thevariable h₇; 18939150203650250186166315242126355786799280592469 isstored in the variable h₈;18932675807273674693936115572103379669380378369473 is stored in thevariable h₉; 18942309965821405414970614992239749691042375170033 isstored in the variable h₁₀;18934229290635176830764035532046510839791719442389 is stored in thevariable h₁₁; 18935834172588603026508807514961653603431968293369 isstored in the variable h₁₂;18938078743053945947831932134835899678969080710281 is stored in thevariable h₁₃; 18930980854114698521197692341107826796840225368461 isstored in the variable h₁₄;18925926348482126046797408190951930473609373791353 is stored in thevariable h₁₅; 18936229724314338327608155999193464492913218459633 isstored in the variable h₁₆;18935389098278487495205740285052812170943878823253 is stored in thevariable h₁₇; 18931691567781542998050896522571358027374445665073 isstored in the variable h₁₈;18932734180610926108166703609049207716180145717849 is stored in thevariable h₁₉; 18938664411743724815803784593761801461579705647693 isstored in the variable h₂₀;18933942752770105179837989473472080616474423254969 is stored in thevariable h₂₁; 18919302986335777367049540268484273861903106390769 isstored in the variable h₂₂;18936075396885270373781711765180522497408613713621 is stored in thevariable h₂₃; 18925604328984592629627465194343191206594160037073 isstored in the variable h₂₄;18929984863788418751836156261712299372083231633577 is stored in thevariable h₂₅; 18929422531793648170111228339741198150094983499776 isstored in the variable h₂₆;18933107954541528865152848804062672753166448460761 is stored in thevariable h₂₇; 18935483634705487053043563594391048299333735703993 isstored in the variable h₂₈;18925896848340062851972136696783348221127455098349 is stored in thevariable h₂₉; 18932368490475205159124453933007681555744686326777 isstored in the variable h₃₀;18922739336864448742750281538719599103232717642873 is stored in thevariable h₃₁; 18930815175217344826609492375186423724694014551957 isstored in the variable h₃₂;18929210510360406226057659372472230885175421077009 is stored in thevariable h₃₃; 18926967327936730178250537884862137815188718140673 isstored in the variable h₃₄;18934063763272126450623787600233843527396400812437 is stored in thevariable h₃₅; 18939120559761876801054292506881700885415287701041 isstored in the variable h₃₆;18928816315710623530089460607608797337081800632473 is stored in thevariable h₃₇; 18929656538570982720438072809652072203857571941789 isstored in the variable h₃₈;18933352933862176606331230531189579186007983024249 is stored in thevariable h₃₉; 18932310663274994445599743180032079937147687805121 isstored in the variable h₄₀;18926381945702726406182624557022344113037957991709 is stored in thevariable h₄₁; and 18931102681789095072229676262975577344314266433617 isstored in the variable h₄₂, respectively.

Finally, the order candidate value computing device 13 combines thecontents of the variables h₁ to h₄₂ together as H and stores the sameinto the H-storing file 165.

The security judging device 14 obtains the H from the H-storing file165, and searches for a candidate value h meeting the security conditionof almost prime number characteristic from the order candidate valuesh₁, h₂, . . . , h₄₂ included in the H, and stores the same into theh-storing file 166. In this form of the embodiment, for briefdescription, the security condition is considered as for the almostprime number characteristic. By use of the known prime number judgingmethod, h₁₁=18934229290635176830764035532046510839791719442389 is judgedto be a prime number, and the security judging device 14 storesh=h₁₁=18934229290635176830764035532046510839791719442389 into theh-storing file 166.

The parameter deciding device 15 obtains a, b, p, and h respectivelyfrom the a-storing file 161, the b-storing file 162, the p-storing file167, and the h-storing file 166, and operates according to theprocessing as shown in FIG. 5.

In Step S51 of FIG. 5, 127994587 that is the primitive 3rd power root of1 with p=163255597 used as the divisor is stored in the variable ζ³, and8342648 that is the primitive 7^(th) power root of 1 with p=163255597used as the divisor is stored in the variable ζ₇.

In Step S52 of FIG. 5, the following processing will be performed on therespective integers 1=1, 2, 3 and the respective integers m=1, 2, 3, 4,5, 6, 7.

When L=1 and m=1, ζ₃=127994587 is stored in the variable ε, andζ₇=8342648 is stored in the variable η. The random element{151707017+104678491 x+123646083 x²+18753988 y+87634493 x³+61274336 xy+x⁴, 138799785+145105684 x+584395 x²+80828873 y+34715892 x³+121885874 xy+59787844 x⁴+x² y, 161162224+117150097 x+100956100 x²+89380061y+140032555 x³+43367019 x y+y²} of the Jacobian group of an algebraiccurve defined by the expression ε y³+ηx⁷+1=127994587 y³+8342648 x⁷+1=0is generated, and this is stored in the variable G, the power ofh=18934229290635176830764035532046510839791719442389 in the Jacobiangroup, on a point stored in the variable G is computed, and the result{133659497+103424746 x+136032897 x²+131029199 y+24618867 x³+114944034 xy+x⁴, 86125426+125891893x+19568269 x²+27044314y+80420960 x³+137562092 xy+x² y, 53604112+65990501 x+51269221 x²+55271502 y+7974233 x³+84922220 xy+y²} is stored in the variable G.

Since the above content of the variable G is not equal to the identityelement { } in the Jacobian group, ζ₃=127994587 is stored in thevariable ε, and ζ₇ ²8342648² mod 163255597=159772073 is stored in thevariable η, as for l=1 and m=2, thereby repeating the above processing.

In the case of the form of this embodiment, when l=2 and m=2, ε=35261009and η=159772073 are obtained, the power ofh=18934229290635176830764035532046510839791719442389 on the pointG={4568071+141843715 x+68256743 x²+71903501 y+128953783 x³+10781960 xy+x⁴, 48272788+45615229 x+150692034 x²+53973350 y+11114765 x³+78550130 xy+61331354 x⁴+x² y, 117552807+135448907 x+64074711 x²+141058974y+49208246 x³+93940317 x y+y²} generated at random results in theidentity element { }, and the parameter deciding device 15 suppliesp=163255597, ε=35261009, η=159772073 as the parameters of a securealgebraic curve.

Finally, the parameters p=163255597, ε=35261009, η=159772073 supplied bythe parameter deciding device 15 are supplied from the output device 18.

This time, the form of a second embodiment according to the presentinvention will be described in detail.

The form of the second embodiment according to the present invention isa secure parameter generating method in an algebraic curve cryptography,comprising:

-   (a) a Stickelberger element computing procedure of requiring the    prime numbers a and b respectively from the a-storing file 161 and    the b-storing file 162 and computing the Stickelberger element ω in    the ab portion of the cyclotomic field;-   (b) a procedure of storing the Stickelberger element ω computed in    the above Stickelberger element computing procedure into the    ω-storing file 163;-   (c) a Jacobian addition candidate value computing procedure of    requiring the prime number a, the prime number b, the size n of an    encryption key, and the Stickelberger element ω respectively from    the a-storing file 161, the b-storing file 162, the n-storing file    168, and ω-storing file 163 and computing the Jacobian addition    candidate value j as for the two different prime numbers a and b and    the prime number p corresponding to the Jacobian addition candidate    value i;-   (d) a procedure of storing the prime number p and the Jacobian    addition candidate value j computed in the above Jacobian addition    candidate value computing procedure, respectively into the p-storing    file 167 and the j-storing file 164;-   (e) an order candidate value computing procedure of requiring the    prime number a, the prime number b, and the Jacobian candidate value    j respectively from the a-storing file 161, the b-storing file 162,    and the j-storing file 164 and computing the class H consisting of a    plurality of candidate values for the order of the Jacobian group of    the algebraic curve specified by the prime number a and the prime    number b;-   (f) a procedure of storing the class H computed in the above order    candidate value computing procedure into the H-storing file 165;-   (g) a security judging procedure of requiring the class H from the    H-storing file 165 and searching for the candidate value h meeting    the security condition such as almost prime number characteristic;-   (h) a procedure of storing the candidate value h found in the above    security judging procedure, into the h-storing file 166; and-   (i) a parameter deciding procedure of requiring the prime number a,    the prime number b, the prime number p, and the candidate value h    respectively from the a-storing file 161, the b-storing file 162,    the p-storing file 167, and the h-storing file 166 and computing a    parameter of an algebraic curve whose order of the Jacobian group is    in accord with the candidate value h, of the algebraic curves    specified by the prime number a, the prime number b, and the prime    number p.

The form of a third embodiment according to the present invention willbe described in detail with reference to the drawings, this time. FIG. 6is a block diagram showing the form of the third embodiment according tothe present invention.

With reference to FIG. 6, the form of the third embodiment of thepresent invention is a storing medium 130 for storing a program forrunning the respective procedures according to the form of the secondembodiment of the present invention, on a computer 100. This program isexecuted after being loaded in a storage of the computer 100.

The present invention is effective in enabling the use of a higher andcomplicated algebraic curve which couldn't be used, for an algebraiccurve cryptography, and improving the security of the algebraic curvecryptography. This is because an algebraic curve having a prime numbersubstantially as the order of the Jacobian group can be foundefficiently from the class of algebraic curves having the followingdefinition equation; αY^(a)+βX^(b)+1=0, thereby expanding the range ofthe usable algebraic curves and dispersedly increasing the decoding workof a hacker.

Although the invention has been illustrated and described with respectto exemplary embodiment thereof, it should be understood by thoseskilled in the art that the foregoing and various other changes,omissions and additions may be made therein and thereto, withoutdeparting from the spirit and scope of the present invention. Therefore,the present invention should not be understood as limited to thespecific embodiment set out above but to include all possibleembodiments which can be embodies within a scope encompassed andequivalents thereof with respect to the feature set out in the appendedclaims.

1. A secure parameter generating device in an algebraic curvecryptography having the definition expression of αY^(a)+βX^(b)+1=0,comprising: an input means for receiving two different prime numbers (a,b) specifying degree of complexity of a curve and size (n) of anencryption key to be used; a Stickelberger element computing devices forcomputing a Stickelberger element (ω) in an ab cyclotomic, based on theprime number (a) and the prime number (b); a Jacobian addition candidatevalue computing device for computing Jacobian addition candidate value jcorresponding to the two different prime numbers a and b, and a primenumber p corresponding to the Jacobian addition candidate value j, basedon the prime number (a), the prime number (b), the size (n) of anencryption key, and the Stickelberger element (ω); an order candidatevalue computing device for computing a class H consisting of a pluralityof candidate values for order of a Jacobian group of an algebraic curvespecified by the prime number a and the prime number b, based on theprime number a, the prime number b, and the Jacobian addition candidatevalue j; a security judging device for searching for a candidate value hmeeting a security condition such as almost prime number characteristicfrom the class H, according to the class H; a parameter deciding devicefor computing a parameter of an algebraic curve whose order of theJacobian group is in accord with the candidate value h, of the algebraiccurves specified by the prime number a, the prime number b, and theprime number p, based on the prime number a, the prime number b, theprime number p, and the candidate value h; and an output device forsupplying the parameter of the algebraic curve computed by saidparameter deciding device to an algebraic curve cryptographic public keysystem.
 2. A secure parameter generating device in an algebraic curvecryptography having the definition expression of αY^(a)+βX^(b)+1=0 asclaimed in claim 1, further comprising: an a-storing means, a b-storingmeans, and an n-storing means for respectively storing the prime numbera, the prime number b, and the size n of the encryption key received bysaid input means; a ω-storing means for storing a Stickelberger elementω computed by said Stickelberger element computing device; a p-storingmeans and a i-storing means for respectively storing the prime number pand the Jacobian addition candidate value j computed by said Jacobianaddition candidate value computing device; an H-storing means forstoring the class H computed by said order candidate value computingdevice; and an h-storing means for storing the candidate value h foundby said security judging device.
 3. A secure parameter generating devicein an algebraic curve cryptography having the definition expression ofαY^(a)+βX^(b)+1=0 as claimed in claim 1, further comprising: saidStickelberger element computing device for computing the Stickelbergerelement ω by use of the equation ω=Σ_(t)[<t/a>+<t/b>]ó_{−t⁻¹} (where, truns on a typical series of irreducible residue class with ab used as adivisor, λ indicates the maximum integer not exceeding a rational numberλ, <λ> indicates a fractional portion λ−[λ] of the rational number λ,ó_(t) indicates Galois mapping ζ→ζ^(t) in the ab cyclotomic (ζ is theprimitive ab root of 1)), based on the prime number a and the primenumber b.
 4. A secure parameter generating device in an algebraic curvecryptography having the definition expression of αY^(a)+βX^(b)+1=0 asclaimed in claim 1, further comprising: said Jacobian addition candidatevalue computing device for generating α at random, which is an algebraicinteger ω generating a prime ideal of a cyclotomic K generated by theprimitive ab root of 1 and whose absolute norm becomes the prime numberp of bit length 2n/(a−1)(b−1) or so, based on the prime number a, theprime number b, the size n of the encryption key, and the Stickelbergerelement ω, and computing the Jacobian addition candidate value j by useof the equation j=γ^(ω.)
 5. A secure parameter generating device in analgebraic curve cryptography having the definition expression ofαY^(a)+βX^(b)+1=0 as claimed in claim 1, further comprising: saidStickelberger element computing device for computing the Stickelbergerelement ω by use of the equation ω=Σ_(t)[<t/a>+<t/b>]ó_{−t⁻¹} (where, truns on a typical series of irreducible residue class with ab used as adivisor, [λ] indicates the maximum integer not exceeding a rationalnumber λ, <λ> indicates a fractional portion λ−[λ] of the rationalnumber λ, ó_(t) indicates Galois mapping ζ→ζ^(t) in the ab cyclotomic (ζis the primitive ab root of 1)), based on the prime number a and theprime number b; and said Jacobian addition candidate value computingdevice for generating α at random, which is an algebraic integer γgenerating a prime ideal of a cyclotomic K generated by the primitive abroot of 1 and whose absolute norm becomes the prime number p of bitlength 2n/(a−1)(b−1) or so, based on the prime number a, the primenumber b, the size n of the encryption key, and the Stickelbergerelement o), and computing the Jacobian addition candidate value j by useof the equation j=γ^(ω).
 6. A secure parameter generating device in analgebraic curve cryptography having the definition expression ofαY^(a)+βX^(b)+1=0 as claimed in claim 1, further comprising: said ordercandidate value computing device for computing a candidate value h_(k)for the order of the Jacobian group of an algebraic curve specified bythe parameters a and b, using the equation h_(k)=Norm_(K|Q)(1+(−ζ)^(k)j)(where Norm_{K|Q} is a norm mapping in the ab cyclotomic K), as for eachk that is an integer from 1 to 2ab inclusively, when ζ is the primitiveab root of 1, based on the prime number a, the prime number b, and theJacobian addition candidate value j, and computing the class of thecandidate values, H={h₁,h₂, . . . ,h_(2ab)}.
 7. A secure parametergenerating device in an algebraic curve cryptography having thedefinition expression of αY^(a)+βX^(b)+1=0 as claimed in claim 1,further comprising: said Stickelberger element computing device forcomputing the Stickelberger element ω by use of the equationω=Σ_(t)[<t/a>+<t/b>]ó_{−t⁻¹} (where, t runs on a typical series ofirreducible residue class with ab used as a divisor, [λ] indicates themaximum integer not exceeding a rational number λ, <λ> indicates afractional portion λ−[λ] of the rational number λ, ó_(t) indicatesGalois mapping ζ→ζ^(t) in the ab cyclotomic (ζ is the primitive ab rootof 1)), based on the prime number a and the prime number b; and saidorder candidate value computing device for computing a candidate valueh_(k) for the order of the Jacobian group of an algebraic curvespecified by the parameters a and b, using the equationh_(k)=Norm_(K|Q)(1+(−ζ)^(k)j) (where Norm_{K|Q} is a norm mapping in theab cyclotomic K), as for each k that is an integer from 1 to 2abinclusively, when ζ is the primitive ab root of 1, based on the primenumber a, the prime number b, and the Jacobian addition candidate valuej, and computing the class of the candidate values, H={h₁,h₂, . . .,h_(2ab)}.
 8. A secure parameter generating device in an algebraic curvecryptography having the definition expression of αY^(a)+βX^(b)+1=0 asclaimed in claim 1, further comprising: said Jacobian addition candidatevalue computing device for generating α at random, which is an algebraicinteger γ generating a prime ideal of a cyclotomic K generated by theprimitive ab root of 1 and whose absolute norm becomes the prime numberp of bit length 2n/(a−1)(b−1) or so, based on the prime number a, theprime number b, the size n of the encryption key, and the Stickelbergerelement ω, and computing the Jacobian addition candidate value j by useof the equation j=γ^(ω); and said order candidate value computing devicefor computing a candidate value h_(k) for the order of the Jacobiangroup of an algebraic curve specified by the parameters a and b, usingthe equation h_(k)=Norm_(K|Q)(1+(−ζ)^(k)j) (where Norm_{K|Q} is a normmapping in the ab cyclotomic K), as for each k that is an integer from 1to 2ab inclusively, when ζ is the primitive ab root of 1, based on theprime number a, the prime number b, and the Jacobian addition candidatevalue j, and computing the class of the candidate values, H={h₁,h₂, . .. ,h_(2ab)}.
 9. A secure parameter generating device in an algebraiccurve cryptography having the definition expression of αY^(a)+βX^(b)+1=0as claimed in claim 1, further comprising: said Stickelberger elementcomputing device for computing the Stickelberger element ω by use of theequation ω=Σ_(t)[<t/a>+<t/b>]ó_{−t⁻¹} (where, t runs on a typical seriesof irreducible residue class with ab used as a divisor, [λ] indicatesthe maximum integer not exceeding a rational number λ, <λ> indicates afractional portion λ−[λ] of the rational number λ, ó_(t) indicatesGalois mapping ζ→ζ^(t) in the ab cyclotomic (ζ is the primitive ab rootof 1)), based on the prime number a and the prime number b; saidJacobian addition candidate value computing device for generating α atrandom, which is an algebraic integer γ generating a prime ideal of acyclotomic K generated by the primitive ab root of 1 and whose absolutenorm becomes the prime number p of bit length 2n/(a−1)(b−1) or so, basedon the prime number a, the prime number b, the size n of the encryptionkey, and the Stickelberger element ω, and computing the Jacobianaddition candidate value j by use of the equation j=γ^(ω); and saidorder candidate value computing device for computing a candidate valueh_(k) for the order of the Jacobian group of an algebraic curvespecified by the parameters a and b, using the equationh_(k)=Norm_(K|Q)(1+(−ζ)^(k)j) (where Norm_{K|Q} is a norm mapping in theab cyclotomic K), as for each k that is an integer from 1 to 2abinclusively, when ζ is the primitive ab root of 1, based on the primenumber a, the prime number b, and the Jacobian addition candidate valuej, and computing the class of the candidate values, H={h₁,h₂, . . .,h_(2ab)}.
 10. A secure parameter generating device in an algebraiccurve cryptography having the definition expression of αY^(a)+βX^(b)+1=0as claimed in claim 1, further comprising: said parameter decidingdevice for requiring the primitive a root ζ_(a) and the primitive b rootζ_(b) of 1 with the prime number p used as the divisor, based on theprime number a, the prime number b, the prime number p, and thecandidate value h, generating a random point G over an algebraic curvedefined by the equation ζ_(a) ¹Y_(a)+ζ_(b) ^(m)X^(b)+1=0, as for eachinteger 1 from 1 to a inclusively and each integer m from 1 to binclusively, computing the h-fold of an element in the Jacobian groupindicated by the point G, and supplying p, ζ_(a) ¹, and ζ_(b) ^(m) asthe parameter of an algebraic curve whose order of the Jacobian group isin accord with the candidate value h, of the algebraic curves specifiedby the prime number a and the prime number b if the result is equal toan identity element in the Jacobian group.
 11. A secure parametergenerating device in an algebraic curve cryptography having thedefinition expression of αY^(a)+βX^(b)+1=0 as claimed in claim 1,further comprising: said Stickelberger element computing device forcomputing the Stickelberger element ω by use of the equationω=Σ_(t)[<t/a>+<t/b>]ó_{−t⁻¹} (where, t runs on a typical series ofirreducible residue class with ab used as a divisor, [λ] indicates themaximum integer not exceeding a rational number λ, <λ> indicates afractional portion λ−[λ] of the rational number λ, ó_(t) indicatesGalois mapping ζ→ζ^(t) in the ab cyclotomic (ζ is the primitive ab rootof 1)), based on the prime number a and the prime number b; and saidparameter deciding device for requiring the primitive a root ζ_(a) andthe primitive b root ζ_(b) of 1 with the prime number p used as thedivisor, based on the prime number a, the prime number b, the primenumber p, and the candidate value h, generating a random point G over analgebraic curve defined by the equation ζ_(a) ¹, Y^(a)+ζ_(b)^(m)X^(b)+1=0, as for each integer 1 from 1 to a inclusively and eachinteger in from 1 to b inclusively, computing the h-fold of an elementin the Jacobian group indicated by the point G, and supplying p, ζ_(a)¹, and ζ_(b) ^(m) as the parameter of an algebraic curve whose order ofthe Jacobian group is in accord with the candidate value h, of thealgebraic curves specified by the prime number a and the prime number bif the result is equal to an identity element in the Jacobian group. 12.A secure parameter generating device in an algebraic curve cryptographyhaving the definition expression of αY^(a)+βX^(b)+1=0 as claimed inclaim 1, further comprising: said Jacobian addition candidate valuecomputing device for generating α at random, which is an algebraicinteger γ generating a prime ideal of a cyclotomic K generated by theprimitive ab root of 1 and whose absolute norm becomes the prime numberp of bit length 2n/(a−1)(b−1) or so, based on the prime number a, theprime number b, the size n of the encryption key, and the Stickelbergerelement ω, and computing the Jacobian addition candidate value j by useof the equation j=γ^(ω); and said parameter deciding device forrequiring the primitive a root ζ_(a) and the primitive b root ζ_(b) of 1with the prime number p used as the divisor, based on the prime numbera, the prime number b, the prime number p, and the candidate value h,generating a random point G over an algebraic curve defined by theequation ζ_(a) ¹, Y^(a)+ζ_(b) ^(m)X^(b)+1=0, as for each integer 1 from1 to a inclusively and each integer m from 1 to b inclusively, computingthe h-fold of an element in the Jacobian group indicated by the point G,and supplying p, ζ_(a) ¹, and ζ_(b) ^(m) as the parameter of analgebraic curve whose order of the Jacobian group is in accord with thecandidate value h, of the algebraic curves specified by the prime numbera and the prime number b if the result is equal to an identity elementin the Jacobian group.
 13. A secure parameter generating device in analgebraic curve cryptography having the definition expression ofαY^(a)+βX^(b)+1=0 as claimed in claim 1, further comprising: said ordercandidate value computing device for computing a candidate value h_(k)for the order of the Jacobian group of an algebraic curve specified bythe parameters a and b, using the equation h_(k)=Norm_(K|Q)(1+(−ζ)^(k)j)(where Norm_{K|Q}, is a norm mapping in the ab cyclotomic K), as foreach k that is an integer from 1 to 2ab inclusively, when ζ is theprimitive ab root of 1, based on the prime number a, the prime number b,and the Jacobian addition candidate value j, and computing the class ofthe candidate values, H={h₁,h₂, . . . ,h_(2ab)}; and said parameterdeciding device for requiring the primitive a root ζ_(a) and theprimitive b root ζ_(b) of 1 with the prime number p used as the divisor,based on the prime number a, the prime number b, the prime number p, andthe candidate value h, generating a random point G over an algebraiccurve defined by the equation ζ_(a) ¹, Y^(a)+ζ_(b) ^(m)X^(b)+1=0, as foreach integer 1 from 1 to a inclusively and each integer in from 1 to binclusively, computing the h-fold of an element in the Jacobian groupindicated by the point G, and supplying p, ζ_(a) ¹, and ζ_(b) ^(m) asthe parameter of an algebraic curve whose order of the Jacobian group isin accord with the candidate value h, of the algebraic curves specifiedby the prime number a and the prime number b if the result is equal toan identity element in the Jacobian group.
 14. A secure parametergenerating device in an algebraic curve cryptography having thedefinition expression of αY^(a)+ζX^(b)+1=0 as claimed in claim 1,further comprising: said Stickelberger element computing device forcomputing the Stickelberger element ω by use of the equationω=Σ_(t)[<t/a>+<t/b>]ó_{−t⁻¹} (where, t runs on a typical series ofirreducible residue class with ab used as a divisor, [λ] indicates themaximum integer not exceeding a rational number λ, <λ> indicates afractional portion λ−[λ] of the rational number λ, ó_(t) indicatesGalois mapping ζ→ζ^(t) in the ab cyclotomic (ζ is the primitive ab rootof 1)), based on the prime number a and the prime number b; saidJacobian addition candidate value computing device for generating α atrandom, which is an algebraic integer γ generating a prime ideal of acyclotomic K generated by the primitive ab root of 1 and whose absolutenorm becomes the prime number p of bit length 2n/(a−1)(b−1) or so, basedon the prime number a, the prime number b, the size n of the encryptionkey, and the Stickelberger element ω, and computing the Jacobianaddition candidate value j by use of the equation j=γ^(ω); and saidparameter deciding device for requiring the primitive a root ζ_(a) andthe primitive b root ζ_(b) of 1 with the prime number p used as thedivisor, based on the prime number a, the prime number b, the primenumber p, and the candidate value h, generating a random point G over analgebraic curve defined by the equation ζ_(a) ¹, Y^(a)+ζ_(b)^(m)X^(b)+1=0, as for each integer 1 from 1 to a inclusively and eachinteger in from 1 to b inclusively, computing the h-fold of an elementin the Jacobian group indicated by the point G, and supplying p, ζ_(a)¹, and ζ_(b) ^(m) as the parameter of an algebraic curve whose order ofthe Jacobian group is in accord with the candidate value h, of thealgebraic curves specified by the prime number a and the prime number bif the result is equal to an identity element in the Jacobian group. 15.A secure parameter generating device in an algebraic curve cryptographyhaving the definition expression of αY^(a)+βX^(b)+1=0 as claimed inclaim 1, further comprising: said Stickelberger element computing devicefor computing the Stickelberger element ω by use of the equationω=Σ_(t)[<t/a>+<t/b>]ó_{−t⁻¹} (where, t runs on a typical series ofirreducible residue class with ab used as a divisor, [λ] indicates themaximum integer not exceeding a rational number λ, <λ> indicates afractional portion λ−[λ] f the rational number λ, ó_(t) indicates Galoismapping ζ→ζ^(t) in the ab cyclotomic (ζ is the primitive ab root of 1)),based on the prime number a and the prime number b; said order candidatevalue computing device for computing a candidate value h_(k) for theorder of the Jacobian group of an algebraic curve specified by theparameters a and b, using the equation h_(k)=Norm_(K/Q)(1+(−ζ)^(k)j)(where Norm_{K|Q} is a norm mapping in the ab cyclotomic K), as for eachk that is an integer from 1 to 2ab inclusively, when ζ is the primitiveab root of 1, based on the prime number a, the prime number b, and theJacobian addition candidate value j, and computing the class of thecandidate values, H={h₁,h₂, . . . ,h_(2ab)}; and said parameter decidingdevice for requiring the primitive a root ζ_(a) and the primitive b rootζ_(b) of 1 with the prime number p used as the divisor, based on theprime number a, the prime number b, the prime number p, and thecandidate value h, generating a random point G over an algebraic curvedefined by the equation ζ_(a) ¹, Y^(a)+ζ_(b) ^(m)X^(b)+1=0, as for eachinteger 1 from 1 to a inclusively and each integer in from 1 to binclusively, computing the h-fold of an element in the Jacobian groupindicated by the point G, and supplying p, ζ_(a) ¹, and ζ_(b) ^(m) asthe parameter of an algebraic curve whose order of the Jacobian group isin accord with the candidate value h, of the algebraic curves specifiedby the prime number a and the prime number b if the result is equal toan identity element in the Jacobian group.
 16. A secure parametergenerating device in an algebraic curve cryptography having thedefinition expression of αY^(a)+βX^(b)+1=0 as claimed in claim 1,further comprising: said Jacobian addition candidate value computingdevice for generating α at random, which is an algebraic integer γgenerating a prime ideal of a cyclotomic K generated by the primitive abroot of 1 and whose absolute norm becomes the prime number p of bitlength 2n/(a−1)(b−1) or so, based on the prime number a, the primenumber b, the size n of the encryption key, and the Stickelbergerelement co, and computing the Jacobian addition candidate value j by useof the equation j=γ^(ω); said order candidate value computing device forcomputing a candidate value h_(k) for the order of the Jacobian group ofan algebraic curve specified by the parameters a and b, using theequation h_(k)=Norm_(K/Q)(1+(−ζ)^(k)j) (where Norm_{K|Q} is a normmapping in the ab cyclotomic K), as for each k that is an integer from 1to 2ab inclusively, when ζ is the primitive ab root of 1, based on theprime number a, the prime number b, and the Jacobian addition candidatevalue j, and computing the class of the candidate values, H={h₁,h₂, . .. ,h_(2ab)}; and said parameter deciding device for requiring theprimitive a root ζ_(a) and the primitive b root ζ_(b) of 1 with theprime number p used as the divisor, based on the prime number a, theprime number b, the prime number p, and the candidate value h,generating a random point G over an algebraic curve defined by theequation ζ_(a) ¹, Y^(a)+ζ_(b) ^(m)X^(b)+1=0, as for each integer 1 from1 to a inclusively and each integer m from 1 to b inclusively, computingthe h-fold of an element in the Jacobian group indicated by the point G,and supplying p, ζ_(a) ¹, and ζ_(b) ^(m) as the parameter of analgebraic curve whose order of the Jacobian group is in accord with thecandidate value h, of the algebraic curves specified by the prime numbera and the prime number b if the result is equal to an identity elementin the Jacobian group.
 17. A secure parameter generating device in analgebraic curve cryptography having the definition expression ofαY^(a)+βX^(b)+1=0 as claimed in claim 1, further comprising: saidStickelberger element computing device for computing the Stickelbergerelement ω by use of the equation ω=Σ_(t)[<t/a>+<t/b>]ó_{−t⁻¹} (where, truns on a typical series of irreducible residue class with ab used as adivisor, [λ] indicates the maximum integer not exceeding a rationalnumber λ, <λ> indicates a fractional portion λ−[λ] of the rationalnumber λ, ó_(t) indicates Galois mapping ζ→ζ^(t) in the ab cyclotomic (ζis the primitive ab root of 1)), based on the prime number a and theprime number b; said Jacobian addition candidate value computing devicefor generating α at random, which is an algebraic integer γ generating aprime ideal of a cyclotomic K generated by the primitive ab root of 1and whose absolute norm becomes the prime number p of bit length2n/(a−1)(b−1) or so, based on the prime number a, the prime number b,the size n of the encryption key, and the Stickelberger element c, andcomputing the Jacobian addition candidate value j by use of the equationj=γ^(ω); said order candidate value computing device for computing acandidate value h_(k) for the order of the Jacobian group of analgebraic curve specified by the parameters a and b, using the equationh_(k)=Norm_(K/Q)(1+(−ζ)^(k)j) (where Norm_{K|Q} is a norm mapping in theab cyclotomic K), as for each k that is an integer from 1 to 2abinclusively, when ζ is the primitive ab root of 1, based on the primenumber a, the prime number b, and the Jacobian addition candidate valuej, and computing the class of the candidate values, H={h₁,h₂, . . .,h_(2ab)}; and said parameter deciding device for requiring theprimitive a root ζ_(a) and the primitive b root ζ_(b) of 1 with theprime number p used as the divisor, based on the prime number a, theprime number b, the prime number p, and the candidate value h,generating a random point G over an algebraic curve defined by theequation ζ_(a) ¹, Y^(a)+ζ_(b) ^(m)X^(b)+1=0, as for each integer 1 from1 to a inclusively and each integer m from 1 to b inclusively, computingthe h-fold of an element in the Jacobian group indicated by the point G,and supplying p, ζ_(a) ¹, and ζ_(b) ^(m) as the parameter of analgebraic curve whose order of the Jacobian group is in accord with thecandidate value h, of the algebraic curves specified by the prime numbera and the prime number b if the result is equal to an identity elementin the Jacobian group.
 18. A secure parameter generating method in analgebraic curve cryptography having the definitions expression ofαY^(a)+βX^(b)+1=0, comprising the steps of: a Stickelberger elementcomputing procedure for computing a Stickelberger element ω in an abcyclotomic, respectively based on two different prime numbers a and bspecifying degree of complexity of curve; a Jacobian addition candidatevalue computing, procedure for computing Jacobian addition candidatevalue j corresponding to the two different prime numbers a and b, and aprime number p corresponding to the Jacobian addition candidate value j,respectively based on the prime number a, the prime number b, the size nof an encryption key, and the Stickelberger element ω; an ordercandidate value computing procedure for computing a class H consistingof a plurality of candidate values for order of a Jacobian group of analgebraic curve specified by the prime number a and the prime number b,respectively based on the prime number a, the prime number b, and theJacobian addition candidate value j; a security judging procedure forsearching for a candidate value h meeting a security condition such asalmost prime number characteristic from the class H, according to theclass H; and a parameter deciding procedure for computing a parameter ofan algebraic curve whose order of the Jacobian group is in accord withthe candidate value h, of the algebraic curves specified by the primenumber a, the prime number b, and the prime number p, respectively basedon the prime number a, the prime number b the prime number p, and the,candidate value h; and supplying said parameter to an algebraic curvecryptographic public key system.
 19. A secure parameter generatingmethod in an algebraic curve cryptography having the definitionexpression of αY^(a)+βX^(b)+1=0 as claimed in claim 18, furthercomprising: a procedure for storing a Stickelberger element o computedby said Stickelberger element computing procedure into said ω-storingmeans; a procedure for respectively storing the prime number p and theJacobian addition candidate value j computed by said Jacobian additioncandidate value computing procedure into said p-storing means andj-storing means; a procedure for storing the class H computed by saidorder candidate value computing procedure into said H-storing means; anda procedure for storing the candidate value h found by said securityjudging procedure into said h-storing means.
 20. A secure parametergenerating method in an algebraic curve cryptography having thedefinition expression of αY^(a)+βX^(b)+1=0 as claimed in claim 18,further comprising: said Stickelberger element computing procedure forcomputing the Stickelberger element ω by use of the equationω=Σ_(t)[<t/a>+<t/b>]ó_{−t⁻¹} (where, t runs on a typical series ofirreducible residue class with ab used as a divisor, [λ] indicates themaximum integer not exceeding a rational number λ, <λ> indicates afractional portion λ−[λ] of the rational number λ, ó_(t) indicatesGalois mapping ζ→ζ^(t) in the ab cyclotomic (ζ is the primitive ab rootof 1)), based on the prime number a and the prime number b.
 21. A secureparameter generating method in an algebraic curve cryptography havingthe definition expression of αY^(a)+βX^(b)+1=0 as claimed in claim 18,further comprising: said Jacobian addition candidate value computingprocedure for generating α at random, which is an algebraic integer γgenerating a prime ideal of a cyclotomic K generated by the primitive abroot of 1 and whose absolute norm becomes the prime number p of bitlength 2n/(a−1)(b−1) or so, based on the prime number a, the primenumber b, the size n of the encryption key, and the Stickelbergerelement c, and computing the Jacobian addition candidate value j by useof the equation j=γ^(ω).
 22. A secure parameter generating method in analgebraic curve cryptography having the definition expression ofαY^(a)+βX^(b)+1=0 as claimed in claim 18, further comprising: saidStickelberger element computing procedure for computing theStickelberger element ω by use of the equationω=Σ_(t)[<t/a>+<t/b>]ó_{−t⁻¹} (where, t runs on a typical series ofirreducible residue class with ab used as a divisor, [λ] indicates themaximum integer not exceeding a rational number λ, <λ> indicates afractional portion λ−[λ] of the rational number λ, ó_(t) indicatesGalois mapping ζ→ζ^(t) in the ab cyclotomic (ζ is the primitive ab rootof 1)), based on the prime number a and the prime number b; and saidJacobian addition candidate value computing procedure for generating αat random, which is an algebraic integer γ generating a prime ideal of acyclotomic K generated by the primitive ab root of 1 and whose absolutenorm becomes the prime number p of bit length 2n/(a−1)(b−1) or so, basedon the prime number a, the prime number b, the size n of the encryptionkey, and the Stickelberger element ω, and computing the Jacobianaddition candidate value j by use of the equation j=γ^(ω.)
 23. A secureparameter generating method in an algebraic curve cryptography havingthe definition expression of αY^(a)+βX^(b)+1=0 as claimed in claim 18,further comprising: said order candidate value computing procedure forcomputing a candidate value h_(k) for the order of the Jacobian group ofan algebraic curve specified by the parameters a and b, using theequation h_(k)=Norm_(K/Q)(1+(−ζ)^(k)j) (where Norm_{K|Q} is a normmapping in the ab cyclotomic K), as for each k that is an integer from 1to 2ab inclusively, when ζ is the primitive ab root of 1, based on theprime number a, the prime number b, and the Jacobian addition candidatevalue j, and computing the class of the candidate values, H={h₁,h₂, . .. ,h_(2ab)}.
 24. A secure parameter generating method in an algebraiccurve cryptography having the definition expression of αY^(a)+βX^(b)+1=0as claimed in claim 18, further comprising: said Stickelberger elementcomputing procedure for computing the Stickelberger element ω by use ofthe equation ω=Σ_(t)[<t/a>+<t/b>]ó_{−t⁻¹} (where, t runs on a typicalseries of irreducible residue class with ab used as a divisor, [λ]indicates the maximum integer not exceeding a rational number λ, <λ>indicates a fractional portion λ−[λ] of the rational number λ, ó_(t)indicates Galois mapping ζ→ζ^(t) in the ab cyclotomic (ζ is theprimitive ab root of 1)), based on the prime number a and the primenumber b; and said order candidate value computing procedure forcomputing a candidate value h_(k) for the order of the Jacobian group ofan algebraic curve specified by the parameters a and b, using theequation h_(k)=Norm_(K/Q)(1+(−ζ)^(k)j) (where Norm_{K|Q} is a normmapping in the ab cyclotomic K), as for each k that is an integer from 1to 2ab inclusively, when ζ is the primitive ab root of 1, based on theprime number a, the prime number b, and the Jacobian addition candidatevalue j, and computing the class of the candidate values, H={h₁,h₂, . .. ,h_(2ab)}.
 25. A secure parameter generating method in an algebraiccurve cryptography having the definition expression of αY^(a)+βX^(b)+1=0as claimed in claim 18, further comprising: said Jacobian additioncandidate value computing procedure for generating α at random, which isan algebraic integer 1 generating a prime ideal of a cyclotomic Kgenerated by the primitive ab root of 1 and whose absolute norm becomesthe prime number p of bit length 2n/(a−1)(b−1) or so, based on the primenumber a, the prime number b, the size n of the encryption key, and theStickelberger element co, and computing the Jacobian addition candidatevalue j by use of the equation j=γ^(ω); and said order candidate valuecomputing procedure for computing a candidate value h_(k) for the orderof the Jacobian group of an algebraic curve specified by the parametersa and b, using the equation h_(k)=Norm_(K/Q)(1+(−ζ)^(k)j) (whereNorm_{K|Q} is a norm mapping in the ab cyclotomic K), as for each k thatis an integer from 1 to 2ab inclusively, when ζ is the primitive ab rootof 1, based on the prime number a, the prime number b, and the Jacobianaddition candidate value j, and computing the class of the candidatevalues, H={h₁,h₂, . . . ,h_(2ab)}.
 26. A secure parameter generatingmethod in an algebraic curve cryptography having the definitionexpression of αY^(a)+βX^(b)+1=0 as claimed in claim 18, furthercomprising: said Stickelberger element computing procedure for computingthe Stickelberger element ω by use of the equationω=Σ_(t)[<t/a>+<t/b>]ó_{−t⁻¹} (where, t runs on a typical series ofirreducible residue class with ab used as a divisor, [λ] indicates themaximum integer not exceeding a rational number λ, <λ> indicates afractional portion λ−[λ] of the rational number λ, ó_(t) indicatesGalois mapping ζ→ζ^(t) in the ab cyclotomic (ζ is the primitive ab rootof 1)), based on the prime number a and the prime number b; saidJacobian addition candidate value computing procedure for generating αat random, which is an algebraic integer γ generating a prime ideal of acyclotomic K generated by the primitive ab root of 1 and whose absolutenorm becomes the prime number p of bit length 2n/(a−1)(b−1) or so, basedon the prime number a, the prime number b, the size n of the encryptionkey, and the Stickelberger element 0), and computing the Jacobianaddition candidate value j by use of the equation j=γ^(ω); and saidorder candidate value computing procedure for computing a candidatevalue h_(k) for the order of the Jacobian group of an algebraic curvespecified by the parameters a and b, using the equationh_(k)=Norm_(K/Q)(1+(−ζ)^(k)j) (where Norm_{K|Q} is a norm mapping in theab cyclotomic K), as for each k that is an integer from 1 to 2abinclusively, when ζ is the primitive ab root of 1, based on the primenumber a, the prime number b, and the Jacobian addition candidate valuej, and computing the class of the candidate values, H={h₁,h₂, . . .,h_(2ab)}.
 27. A secure parameter generating method in an algebraiccurve cryptography having the definition expression of αY^(a)+βX^(b)+1=0as claimed in claim 18, further comprising: said parameter decidingprocedure for requiring the primitive a root ζ_(a) and the primitive broot ζ_(b) of 1 with the prime number p used as the divisor, based onthe prime number a, the prime number b, the prime number p, and thecandidate value h, generating a random point G over an algebraic curvedefined by the equation ζ_(a) ¹, Y^(a)+ζ_(b) ^(m)X^(b)+1=0, as for eachinteger 1 from 1 to a inclusively and each integer in from 1 to binclusively, computing ζ the h-fold of an element in the Jacobian groupindicated by the point G, and supplying p, ζ_(a) ¹, and ζ_(b) ^(m) asthe parameter of an algebraic curve whose order of the Jacobian group isin accord with the candidate value h, of the algebraic curves specifiedby the prime number a and the prime number b if the result is equal toan identity element in the Jacobian group.
 28. A secure parametergenerating method in an algebraic curve cryptography having thedefinition expression of αY^(a)+βX^(b)+1=0 as claimed in claim 18,further comprising: said Stickelberger element computing procedure forcomputing the Stickelberger element ω by use of the equationω=Σ_(t)[<t/a>+<t/b>]ó_{−t⁻¹} (where, t runs on a typical series ofirreducible residue class with ab used as a divisor, [λ] indicates themaximum integer not exceeding a rational number λ, <λ> indicates afractional portion λ−[λ] of the rational number λ, ó_(t) indicatesGalois mapping ζ→ζ^(t) in the ab cyclotomic (ζ is the primitive ab rootof 1)), based on the prime number a and the prime number b; and saidparameter deciding procedure for requiring the primitive a root ζ_(a)and the primitive b root ζ_(b) of 1 with the prime number p used as thedivisor, based on the prime number a, the prime number b, the primenumber p, and the candidate value h, generating a random point G over analgebraic curve defined by the equation ζ_(a) ¹, Y^(a)+ζ_(b)^(m)X^(b)+1=0, as for each integer 1 from 1 to a inclusively and eachinteger in from 1 to b inclusively, computing the h-fold of an elementin the Jacobian group indicated by the point G, and supplying p, ζ_(a)¹, and ζ_(b) ^(m) as the parameter of an algebraic curve whose order ofthe Jacobian group is in accord with the candidate value h, of thealgebraic curves specified by the prime number a and the prime number bif the result is equal to an identity element in the Jacobian group. 29.A secure parameter generating method in an algebraic curve cryptographyhaving the definition expression of αY^(a)+βX^(b)+1=0 as claimed inclaim 18, further comprising: said Jacobian addition candidate valuecomputing procedure for generating α at random, which is an algebraicinteger γ generating a prime ideal of a cyclotomic K generated by theprimitive ab root of 1 and whose absolute norm becomes the prime numberp of bit length 2n/(a−1)(b−1) or so, based on the prime number a, theprime number b, the size n of the encryption key, and the Stickelbergerelement ω, and computing the Jacobian addition candidate value j by useof the equation j=γ^(ω); and said parameter deciding procedure forrequiring the primitive a root ζ_(a) and the primitive b root ζ_(b) of 1with the prime number p used as the divisor, based on the prime numbera, the prime number b, the prime number p, and the candidate value h,generating a random point G over an algebraic curve defined by theequation ζ_(a) ¹, Y^(a)+ζ_(b) ^(m)X^(b)+1=0, as for each integer 1 from1 to a inclusively and each integer in from 1 to b inclusively,computing the h-fold of an element in the Jacobian group indicated bythe point G, and supplying p, ζ_(a) ¹, and ζ_(b) ^(m) as the parameterof an algebraic curve whose order of the Jacobian group is in accordwith the candidate value h, of the algebraic curves specified by theprime number a and the prime number b if the result is equal to anidentity element in the Jacobian group.
 30. A secure parametergenerating method in an algebraic curve cryptography having thedefinition expression of αY^(a)+βX^(b)+1=0 as claimed in claim 18,further comprising: said order candidate value computing procedure forcomputing a candidate value h_(k) for the order of the Jacobian group ofan algebraic curve specified by the parameters a and b, using theequation h_(k)=Norm_(K/Q)(1+(−ζ)^(k)j) (where Norm_{K|Q} is a normmapping in the ab cyclotomic K), as for each k that is an integer from 1to 2ab inclusively, when ζ is the primitive ab root of 1, based on theprime number a, the prime number b, and the Jacobian addition candidatevalue j, and computing the class of the candidate values, H={h₁,h₂, . .. ,h_(2ab)}; and said parameter deciding procedure for requiring theprimitive a root ζ_(a) and the primitive b root ζ_(b) of 1 with theprime number p used as the divisor, based on the prime number a, theprime number b, the prime number p, and the candidate value h,generating a random point G over an algebraic curve defined by theequation ζ_(a) ¹, Y^(a)+ζ_(b) ^(m)X^(b)+1=0, as for each integer 1 from1 to a inclusively and each integer in from 1 to b inclusively,computing the h-fold of an element in the Jacobian group indicated bythe point G, and supplying p, ζ_(a) ¹, and ζ_(b) ^(m) as the parameterof an algebraic curve whose order of the Jacobian group is in accordwith the candidate value h, of the algebraic curves specified by theprime number a and the prime number b if the result is equal to anidentity element in the Jacobian group.
 31. A secure parametergenerating method in an algebraic curve cryptography having thedefinition expression of αY^(a)+βX^(b)+1=0 as claimed in claim 18,further comprising: said Stickelberger element computing procedure forcomputing the Stickelberger element ω by use of the equationω=Σ_(t)[<t/a>+<t/b>]ó_{−t⁻¹} (where, t runs on a typical series ofirreducible residue class with ab used as a divisor, [λ] indicates themaximum integer not exceeding a rational number λ, <λ> indicates afractional portion λ−[λ] of the rational number λ, ó_(t) indicatesGalois mapping ζ→ζ^(t) in the ab cyclotomic (ζ is the primitive ab rootof 1)), based on the prime number a and the prime number b; saidJacobian addition candidate value computing procedure for generating αat random, which is an algebraic integer γ generating a prime ideal of acyclotomic K generated by the primitive ab root of 1 and whose absolutenorm becomes the prime number p of bit length 2n/(a−1)(b−1) or so, basedon the prime number a, the prime number b, the size n of the encryptionkey, and the Stickelberger element ω, and computing the Jacobianaddition candidate value j by use of the equation j=γ^(ω); and saidparameter deciding procedure for requiring the primitive a root ζ_(a)and the primitive b root ζ_(b) of 1 with the prime number p used as thedivisor, based on the prime number a, the prime number b, the primenumber p, and the candidate value h, generating a random point G over analgebraic curve defined by the equation ζ_(a) ¹, Y^(a)+ζ_(b)^(m)X^(b)+1=0, as for each integer 1 from 1 to a inclusively and eachinteger m from 1 to b inclusively, computing the h-fold of an element inthe Jacobian group indicated by the point G, and supplying p, ζ_(a) ¹,and ζ_(b) ^(m) as the parameter of an algebraic curve whose order of theJacobian group is in accord with the candidate value h, of the algebraiccurves specified by the prime number a and the prime number b if theresult is equal to an identity element in the Jacobian group.
 32. Asecure parameter generating method in an algebraic curve cryptographyhaving the definition expression of αY^(a)+βX^(b)+1=0 as claimed inclaim 18, further comprising: said Stickelberger element computingprocedure for computing the Stickelberger element ω by use of theequation ω=Σ_(t)[<t/a>+<t/b>]ó_{−t⁻¹} (where, t runs on a typical seriesof irreducible residue class with ab used as a divisor, [λ] indicatesthe maximum integer not exceeding a rational number λ, <λ> indicates afractional portion λ−[λ] of the rational number λ, ó_(t) indicatesGalois mapping ζ→ζ^(t) in the ab cyclotomic (ζ is the primitive ab rootof 1)), based on the prime number a and the prime number b; said ordercandidate value computing procedure for computing a candidate valueh_(k) for the order of the Jacobian group of an algebraic curvespecified by the parameters a and b, using the equationh_(k)=Norm_(K/Q)(1+(−ζ)_(k)j) (where Norm{K|Q} is a norm mapping in theab cyclotomic K), as for each k that is an integer from 1 to 2abinclusively, when ζ is the primitive ab root of 1, based on the primenumber a, the prime number b, and the Jacobian addition candidate valuej, and computing the class of the candidate values, H={h₁,h₂, . . .,h_(2ab)}; and said parameter deciding procedure for requiring theprimitive a root ζ_(a) and the primitive b root ζ_(b) of 1 with theprime number p used as the divisor, based on the prime number a, theprime number b, the prime number p, and the candidate value h,generating a random point G over an algebraic curve defined by theequation ζ_(a) ¹, Y^(a)+ζ_(b) ^(m)X^(b)+1=0, as for each integer 1 from1 to a inclusively and each integer in from 1 to b inclusively,computing the h-fold of an element in the Jacobian group indicated bythe point G, and supplying P, ζ_(a) ¹, and ζ_(b) ^(m) as the parameterof an algebraic curve whose order of the Jacobian group is in accordwith the candidate value h, of the algebraic curves specified by theprime number a and the prime number b if the result is equal to anidentity element in the Jacobian group.
 33. A secure parametergenerating method in an algebraic curve cryptography having thedefinition expression of αY^(a)+βX^(b)+1=0 as claimed in claim 18,further comprising: said Jacobian addition candidate value computingprocedure for generating α at random, which is an algebraic integer γgenerating a prime ideal of a cyclotomic K generated by the primitive abroot of 1 and whose absolute norm becomes the prime number p of bitlength 2n/(a−1)(b−1) or so, based on the prime number a, the primenumber b, the size n of the encryption key, and the Stickelbergerelement c, and computing the Jacobian addition candidate value j by useof the equation j=γ^(ω); said order candidate value computing procedurefor computing a candidate value h_(k) for the order of the Jacobiangroup of an algebraic curve specified by the parameters a and b, usingthe equation h_(k)=Nomr_(K/Q)(1+(−ζ)^(k)j) (where Norm_{K|Q} is a normmapping in the ab cyclotomic K), as for each k that is an integer from 1to 2ab inclusively, when ζ is the primitive ab root of 1, based on theprime number a, the prime number b, and the Jacobian addition candidatevalue j, and computing the class of the candidate values, H={h₁,h₂, . .. ,h_(2ab)}; and said parameter deciding procedure for requiring theprimitive a root ζ_(a) and the primitive b root ζ_(b) of 1 with theprime number p used as the divisor, based on the prime number a, theprime number b, the prime number Pi and the candidate value h,generating a random point G over an algebraic curve defined by theequation ζ_(a) ¹, Y^(a)+ζ_(b) ^(m)X^(b)+1=0, as for each integer 1 from1 to a inclusively and each integer in from 1 to b inclusively,computing the h-fold of an element in the Jacobian group indicated bythe point G, and supplying p, ζ_(a) ¹, and ζ_(b) ^(m) as the parameterof an algebraic curve whose order of the Jacobian group is in accordwith the candidate value h, of the algebraic curves specified by theprime number a and the prime number b if the result is equal to anidentity element in the Jacobian group.
 34. A secure parametergenerating method in an algebraic curve cryptography having thedefinition expression of αY^(a)+βX^(b)+1=0 as claimed in claim 18,further comprising: said Stickelberger element computing procedure forcomputing the Stickelberger element ω by use of the equationω=Σ_(t)[<t/a>+<t/b>]ó_{−t⁻¹} (where, t runs on a typical series ofirreducible residue class with ab used as a divisor, [λ] indicates themaximum integer not exceeding a rational number λ, <λ> indicates afractional portion λ−[λ] of the rational number λ, ó_(t) indicatesGalois mapping ζ→ζ^(t) in the ab cyclotomic (ζ is the primitive ab rootof 1)), based on the prime number a and the prime number b; saidJacobian addition candidate value computing procedure for generating αat random, which is an algebraic integer 1 generating a prime ideal of acyclotomic K generated by the primitive ab root of 1 and whose absolutenorm becomes the prime number p of bit length 2n/(a−1)(b−1) or so, basedon the prime number a, the prime number b, the size n of the encryptionkey, and the Stickelberger element ω, and computing the Jacobianaddition candidate value j by use of the equation j=γ^(ω); said ordercandidate value computing procedure for computing a candidate valueh_(k) for the order of the Jacobian group of an algebraic curvespecified by the parameters a and b, using the equationh_(k)=Norm_(K/Q)(1+(−ζ)^(k)j) (where Norm_{K|Q} is a norm mapping in theab cyclotomic K), as for each k that is an integer from 1 to 2abinclusively, when ζ is the primitive ab root of 1, based on the primenumber a, the prime number b, and the Jacobian addition candidate valuej, and computing the class of the candidate values, H={h₁,h₂, . . .,h_(2ab)}; and said parameter deciding procedure for requiring theprimitive a root ζ_(a) and the primitive b root ζ_(b) of 1 with theprime number p used as the divisor, based on the prime number a, theprime number b, the prime number p, and the candidate value h,generating a random point G over an algebraic curve defined by theequation ζ_(a) ¹, Y^(a)+ζ_(b) ^(m)X^(b)+1=0, as for each integer 1 from1 to a inclusively and each integer in from 1 to b inclusively,computing the h-fold of an element in the Jacobian group indicated bythe point G, and supplying P, ζ_(a) ¹, and ζ_(b) ^(m) as the parameterof an algebraic curve whose order of the Jacobian group is in accordwith the candidate value h, of the algebraic curves specified by theprime number a and the prime number b if the result is equal to anidentity element in the Jacobian group.
 35. A computer readable memorystoring a program for generating a secure parameter in an algebraiccurve cryptography having the definition expression ofαY^(a)+βX^(b)+1=0, which, when executing on a computer causes thecomputer to carry out the steps comprising: a Stickelberger elementcomputing procedure for computing a Stickelberger element co in an abcyclotomic, respectively based on two different prime numbers a and bspecifying degree of complexity of curve; a Jacobian addition candidatevalue computing procedure for computing Jacobian addition candidatevalue j corresponding to the two different prime numbers a and b, and aprime number p corresponding to the Jacobian addition candidate value j,respectively based on the prime number a, the prime number b, the size nof an encryption key, and the Stickelberger element ω; an ordercandidate value computing procedure for computing a class H consistingof a plurality of candidate values for order of a Jacobian group of analgebraic curve specified by the prime number a and the prime number b,respectively based on the prime number a, the prime number b, and theJacobian addition candidate value j; a security judging procedure forsearching for a candidate value h meeting a security condition such asalmost prime number characteristic from the class H, according to theclass H; and a parameter deciding procedure for computing a parameter ofan algebraic curve whose order of the Jacobian group is in accord withthe candidate value h, of the algebraic curves specified by the primenumber a, the prime number b, and the prime number p, respectively basedon the prime number a, the prime number b, the prime number p, and thecandidate value h.
 36. A computer readable memory storing a program forgenerating a secure parameter in an algebraic curve cryptography havingthe definition expression of αY^(a)+βX^(b)+1=0, which, when executing ona computer causes the computer to carry out the steps comprising: aStickelberger element computing procedure for computing theStickelberger element ωby use of the equationω=Σ_(t)[<t/a>+<t/b>]ó_{−t⁻¹} (where, t runs on a typical series ofirreducible residue class with ab used as a divisor, [λ] indicates themaximum integer not exceeding a rational number λ, <λ> indicates afractional portion λ−[λ] of the rational number λ, ó_(t) indicatesGalois mapping ζ→ζ^(t) in the ab cyclotomic (ζ is the primitive ab rootof 1)), based on the prime number a and the prime number b.
 37. Acomputer readable memory storing a program for generating a secureparameter in an algebraic curve cryptography having the definitionexpression of αY^(a)+βX^(b)+1=0, which, when executing on a computercauses the computer to carry out the steps comprising: a Jacobianaddition candidate value computing procedure for generating α at random,which is an algebraic integer γ generating a prime ideal of a cyclotomicK generated by the primitive ab root of 1 and whose absolute normbecomes the prime number p of bit length 2n/(a−1)(b−1) or so, based onthe prime number a, the prime number b, the size n of the encryptionkey, and the Stickelberger element ω, and computing the Jacobianaddition candidate value j by use of the equation j=γ^(ω).
 38. Acomputer readable memory storing a program for generating a secureparameter in an algebraic curve cryptography having the definitionexpression of αY^(a)+βX^(b)+1=0, which, when executing on a computercauses the computer to carry out the steps comprising: an ordercandidate value computing procedure for computing a candidate valueh_(k) for the order of the Jacobian group of an algebraic curvespecified by the parameters a and b, using the equationh_(k)=Norm_(K/Q)(1+(−ζ)^(k)j) (where Norm_{K|Q} is a norm mapping in theab cyclotomic K), as for each k that is an integer from 1 to 2abinclusively, when ζ is the primitive ab root of 1, based on the primenumber a, the prime number b, and the Jacobian addition candidate valuej, and computing the class of the candidate values, H={h₁,h₂, . . .,h_(2ab)}.
 39. A computer readable memory storing a program forgenerating a secure parameter in an algebraic curve cryptography havingthe definition expression of αY^(a)+βX^(b)+1=0, which, when executing ona computer causes the computer to carry out the steps comprising: aparameter deciding procedure for requiring he primitive a root ζ_(a) andthe primitive b root ζ_(b) of 1 with the prime number p used as thedivisor, based on the prime number a, the prime number b, the primenumber p, and the candidate value h, generating a random point G over analgebraic curve defined by the equation ζ_(a) ¹, Y^(a)+ζ_(b)^(m)X^(b)+1=0, as for each integer 1 from 1 to a inclusively and eachinteger in from 1 to b inclusively, computing the h-fold of an elementin the Jacobian group indicated by the point G, and supplying p, ζ_(a)¹, and ζ_(b) ^(m) as the parameter of an algebraic curve whose order ofthe Jacobian group is in accord with the candidate value h, of thealgebraic curves specified by the prime number a and the prime number bif the result is equal to an identity element in the Jacobian group.